Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2024, 05:39

General

  • Target

    456cb72b97bffcbb308d95382bc5f7ab.exe

  • Size

    385KB

  • MD5

    456cb72b97bffcbb308d95382bc5f7ab

  • SHA1

    1663a70901350b66c23a1aa1cb6921c2626f1dd9

  • SHA256

    d8afe2235b27994d29a40060f82abbfddc0bc5d24efec6a53d7e1540e4455ce8

  • SHA512

    83761382baacb6bab8bc0d0dd5476558fda723d9ac6b275be3f15f4e425f189dec9c91fc4c2a1d47344d388ed907a19028509e7fe4ceaea606fc9355f6b0e92c

  • SSDEEP

    6144:1UeSzrb8GTBeI3XDc+7NnKSMZQaoa57Z2+H3o2f2EeobDtLhYQe32B:1UBbzBeQXDc+9KSZa5h42f7bD4QemB

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\456cb72b97bffcbb308d95382bc5f7ab.exe
    "C:\Users\Admin\AppData\Local\Temp\456cb72b97bffcbb308d95382bc5f7ab.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Users\Admin\AppData\Local\Temp\456cb72b97bffcbb308d95382bc5f7ab.exe
      C:\Users\Admin\AppData\Local\Temp\456cb72b97bffcbb308d95382bc5f7ab.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\456cb72b97bffcbb308d95382bc5f7ab.exe

    Filesize

    116KB

    MD5

    ae7c0692e635324e5564822a2b131e08

    SHA1

    65794db92ec3689c31a79808c508daf654f10b7b

    SHA256

    13a5857b16c2432ff3b56f675709ad3e8212a19b1fd43989aa2b42982691f5d5

    SHA512

    feeb9d791c53301049b99ccc951ce59d5af6a11ad558c35265deaab92375b5affc0917fdc89d9f7bec7a4d4b9f35c26bd41a67169ba33d741af55fd27c9ba793

  • C:\Users\Admin\AppData\Local\Temp\Cab428E.tmp

    Filesize

    53KB

    MD5

    a843c6a7638585c52e988363ac9cb704

    SHA1

    1fdd16f449e7eb04209cc332cf1aa7ca0252f48f

    SHA256

    ea0544e432a3b395495aff993eb6270169d877eefdbd9811507cf20d21927667

    SHA512

    78768b1188656ef4a0c6c76bca555534db2e2705abf5e1032f6b0f2b7287ad123876ea308adec708f46b1aac72518bd46ec469775ad4406320881cde940334d6

  • C:\Users\Admin\AppData\Local\Temp\Tar42C0.tmp

    Filesize

    89KB

    MD5

    9a5dd06189d4876c7eefed8fbdb7ffa6

    SHA1

    4f11afdd61d48b388c1e1db79431c2d3f5e8184d

    SHA256

    5b346699b48f38522563715713401bf5b82e444252826d384cdb441dad24d571

    SHA512

    59481a7856b8a4102d81dec1290f6c01f95589c7d871d987bff66523e80352cdd8d78b733761d2b4f82b90ffae802a37ef5085a3fb6865001f3d213567ecd587

  • \Users\Admin\AppData\Local\Temp\456cb72b97bffcbb308d95382bc5f7ab.exe

    Filesize

    152KB

    MD5

    c49f9534811e3f5d089efa3034bd2078

    SHA1

    1115215c146aafd94423f0de9d1c64b38397856f

    SHA256

    75501fd71a34ef114921c4229d625faef28d98a9e85c03d94c8f19487f56fdcd

    SHA512

    0ca8222fada6dd4c8d6d79b0370b7f8cd096fd251cd54ea93ccf191e930754187df9b6acddbf4c3338a90bbc3d4e3fc4723fd9a5319bcd38bb918f0b3e7d0c44

  • memory/2528-12-0x0000000002E30000-0x0000000002E96000-memory.dmp

    Filesize

    408KB

  • memory/2528-15-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2528-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2528-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2528-2-0x0000000000350000-0x00000000003B6000-memory.dmp

    Filesize

    408KB

  • memory/2676-23-0x0000000001470000-0x00000000014CF000-memory.dmp

    Filesize

    380KB

  • memory/2676-22-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2676-18-0x0000000000190000-0x00000000001F6000-memory.dmp

    Filesize

    408KB

  • memory/2676-76-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2676-82-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2676-78-0x000000000D7D0000-0x000000000D80C000-memory.dmp

    Filesize

    240KB