Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 21:03

General

  • Target

    3b0c097bb30396d26b3cfa4d06da47fb.exe

  • Size

    385KB

  • MD5

    3b0c097bb30396d26b3cfa4d06da47fb

  • SHA1

    90db119e3986bf32d71619d89494bdee0007c116

  • SHA256

    a4b0bc18733c1f407ff47f492d3f9c14b19e336f9b49b7984e947923df04283a

  • SHA512

    86216f22b380a3e3e5a364180e7c749208c2035b87663ffd039039cd20c0e78f8e644f199c4689ccce367df42be68eecbd7fbece2cb510c425c1b880cb67ec1d

  • SSDEEP

    12288:vgR27WNZF9zKakxUmRklPX4I7xjtgmaCVbAHUsJNB:vNaNZF9wUmihD70makbAH/bB

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b0c097bb30396d26b3cfa4d06da47fb.exe
    "C:\Users\Admin\AppData\Local\Temp\3b0c097bb30396d26b3cfa4d06da47fb.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Users\Admin\AppData\Local\Temp\3b0c097bb30396d26b3cfa4d06da47fb.exe
      C:\Users\Admin\AppData\Local\Temp\3b0c097bb30396d26b3cfa4d06da47fb.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:1800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab98C8.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar9919.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • \Users\Admin\AppData\Local\Temp\3b0c097bb30396d26b3cfa4d06da47fb.exe

    Filesize

    385KB

    MD5

    6d68d4b94080f92134a4cca17c78f19d

    SHA1

    60f3f1430ee0aaafe7504157bdc4b73c8f196ed6

    SHA256

    d780f645d048463b28a63c4ec3c843439c8708863640ab66ecc1cb8c66a9b70a

    SHA512

    e5373088f2564e4d95bbf1e5330db71d43058f9fe3c865bcd903a9e6adbb10d78d2901754a21d3abb59f98c6f403db1f4988cddeb9570c8671f43a009e3c27a2

  • memory/1796-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1796-4-0x0000000000190000-0x00000000001F6000-memory.dmp

    Filesize

    408KB

  • memory/1796-14-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1796-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/1796-11-0x0000000002E20000-0x0000000002E86000-memory.dmp

    Filesize

    408KB

  • memory/1800-20-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/1800-23-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1800-24-0x0000000002CA0000-0x0000000002CFF000-memory.dmp

    Filesize

    380KB

  • memory/1800-17-0x0000000000220000-0x0000000000286000-memory.dmp

    Filesize

    408KB

  • memory/1800-77-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1800-82-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1800-83-0x0000000008A50000-0x0000000008A8C000-memory.dmp

    Filesize

    240KB