Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2024, 01:42

General

  • Target

    4271e0db6d02b5445fd2171f1193a273.exe

  • Size

    771KB

  • MD5

    4271e0db6d02b5445fd2171f1193a273

  • SHA1

    b53b69b335a9daffd0aa4ad3abb9c53661072cb4

  • SHA256

    5d0cf221808309858ffcb9595b3fd9791d66c012b65438b2615d31b962d8120e

  • SHA512

    4f9134cfa2ae8967b46ed496b41e02f100e83ea596e94fd9bc9b426cda530dc71f153621f8f0c531b1546247069bc853f53ca92e8e41291c79326a92a2c1d983

  • SSDEEP

    12288:mcWQlL5JSFKfxAwkzl3ijwDK0NS8zb10VHmDXTuFaa2AtyGTKOF25ZoJJyhRge8V:TWSJM0Awc9e8zb10hJaothZ2/T6FBBB

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4271e0db6d02b5445fd2171f1193a273.exe
    "C:\Users\Admin\AppData\Local\Temp\4271e0db6d02b5445fd2171f1193a273.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:804
    • C:\Users\Admin\AppData\Local\Temp\4271e0db6d02b5445fd2171f1193a273.exe
      C:\Users\Admin\AppData\Local\Temp\4271e0db6d02b5445fd2171f1193a273.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\4271e0db6d02b5445fd2171f1193a273.exe

    Filesize

    123KB

    MD5

    622c9e878b74b33aabaec96d5cdec40e

    SHA1

    7c9faddff206d1d3bae71683afc6c1e48bba2293

    SHA256

    fa55fc77c3952ab84d01537b61a8cde316477e94a7b2b9fb13a757b6423de107

    SHA512

    d9a144e0832795f0d6d4a2995a18564bcc4be37a76408bf56f05340ad394599e8cba6916b0433b19ea099794faf1fa8244954f1e60a4a5f6a9a639b5c5454472

  • C:\Users\Admin\AppData\Local\Temp\Tar405F.tmp

    Filesize

    92KB

    MD5

    71e4ce8b3a1b89f335a6936bbdafce4c

    SHA1

    6e0d450eb5f316a9924b3e58445b26bfb727001e

    SHA256

    a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

    SHA512

    b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

  • \Users\Admin\AppData\Local\Temp\4271e0db6d02b5445fd2171f1193a273.exe

    Filesize

    381KB

    MD5

    89ddeb63f7c54eb25aa133a731b5c343

    SHA1

    8036a07e8cd7303b416e5e24e06cbfc29e7c8a29

    SHA256

    d6aff167397c7ee4b9d42c9769d039a8dc4368d83b68a2ccb415a274eafa6bae

    SHA512

    739cd9c4a8c549d3441512da6647ec4ddea639bedb9774124a670037858ed3dbbc20553e6be516bf3c21b21ea7af2237839d265bfb2b80355cca9d88e777a20b

  • memory/804-14-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/804-15-0x0000000002FB0000-0x0000000003016000-memory.dmp

    Filesize

    408KB

  • memory/804-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/804-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/804-2-0x0000000000190000-0x00000000001F6000-memory.dmp

    Filesize

    408KB

  • memory/2992-28-0x0000000002C70000-0x0000000002CCF000-memory.dmp

    Filesize

    380KB

  • memory/2992-19-0x0000000000310000-0x0000000000376000-memory.dmp

    Filesize

    408KB

  • memory/2992-23-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2992-16-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2992-82-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2992-88-0x00000000095B0000-0x00000000095EC000-memory.dmp

    Filesize

    240KB

  • memory/2992-87-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB