Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 13:51

General

  • Target

    38b3d34bbea87fc0f1a0eca810f3cba1.exe

  • Size

    5.1MB

  • MD5

    38b3d34bbea87fc0f1a0eca810f3cba1

  • SHA1

    5bb4a254de93a94c4c22c23a95d37e74182261fa

  • SHA256

    b22718b1b2fcbdeb02059be209e8011451667e4ddac2dd3a27e18fc45d7d213f

  • SHA512

    8c597dc5fc965321de25211a56c4c9fa1e4c08b66e66cfb5118ab8b77c23b89500c89c24bb63e997040d3f736309577b3c70fe43806da00378b33ea255d7d9af

  • SSDEEP

    49152:wAMnlFgA8cHiceXtEE8SyZ7e32vdo38E2cAL4uobPNoay3b8D6uGYLdi3PX3CNz0:MPPNeG3/xobPi3v4psdcnwMgb33

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38b3d34bbea87fc0f1a0eca810f3cba1.exe
    "C:\Users\Admin\AppData\Local\Temp\38b3d34bbea87fc0f1a0eca810f3cba1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Users\Admin\AppData\Local\Temp\38b3d34bbea87fc0f1a0eca810f3cba1.exe
      C:\Users\Admin\AppData\Local\Temp\38b3d34bbea87fc0f1a0eca810f3cba1.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:1300

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\38b3d34bbea87fc0f1a0eca810f3cba1.exe

    Filesize

    33KB

    MD5

    2751569239336e993f889f8c7b810946

    SHA1

    8d0f3211f3011d002f1120046f99b283b0c0b92d

    SHA256

    16b791a62b23e7e5a9cfd6ed3b216763e291b3e7b9eb90f6ebe94a4fee28a7c9

    SHA512

    e5ad2687df090dba8d2f8135059d2aafc933cf7836a3546c048f49deeb359e096c7f5e42a76dfb597827145f17e4dfdaeca36a4e659920ae2ee53ffc26aa7c0c

  • \Users\Admin\AppData\Local\Temp\38b3d34bbea87fc0f1a0eca810f3cba1.exe

    Filesize

    78KB

    MD5

    7e2907c229b2d3df9be818c38ae91c02

    SHA1

    3c3c052281d7b9ef2a336d75af5edcdddeabf6e3

    SHA256

    6c4f6112d0341502c183bd97c126ff4d702bbc4992055d116251969e950d0ab3

    SHA512

    c0032056ed6d92ef389ad1d40c0700ca216969165fc5bef3802db1a79d7a789d31eae84f1faf9547c11087cd6f8be92c426ac62a0865b88b6b31d7e75288c530

  • memory/1300-16-0x0000000001FA0000-0x00000000021FA000-memory.dmp

    Filesize

    2.4MB

  • memory/1300-18-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/1300-41-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/2124-1-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/2124-0-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/2124-2-0x0000000001FA0000-0x00000000021FA000-memory.dmp

    Filesize

    2.4MB

  • memory/2124-15-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB