Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    09/01/2024, 12:36

General

  • Target

    6c164898d21921033c68d5fb6c127c5a6e4951944196865a2e2bdb933b9335af.exe

  • Size

    6.1MB

  • MD5

    85595ea8a4c9905e4e1d17870a8a002f

  • SHA1

    53df45deb40b74a4b94fe56480665967745dcb3b

  • SHA256

    6c164898d21921033c68d5fb6c127c5a6e4951944196865a2e2bdb933b9335af

  • SHA512

    daa458b760302fd0b8af690583df9cfe6016a4a0844512d4d0a6bb3c26bca89407a9981108e5ada40443ad5db0c10b352dcc7e1766712debfb697c281a08def3

  • SSDEEP

    196608:ioti/a8qEHhppfwLOH4/7rv+aJQkOEkCcQGM2:9tIU2HYCw+nkCCcQG9

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c164898d21921033c68d5fb6c127c5a6e4951944196865a2e2bdb933b9335af.exe
    "C:\Users\Admin\AppData\Local\Temp\6c164898d21921033c68d5fb6c127c5a6e4951944196865a2e2bdb933b9335af.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    67e216939e3449884911bce1d89db704

    SHA1

    595c5f17357dba81139290984c78864937a375ab

    SHA256

    5e98f76cd44183a91f37a24134055023d3a75c6e84d84b7587f3c4b7f28e03b7

    SHA512

    e16305c801c3c35ad6af7c5972f5be9597ae50b15fa9b84b4113b753efaf8301e4745d121925e1c472e837b7226176b98ea9f48964ede86e4b4d5882d484ae78

  • C:\Users\Admin\AppData\Local\Temp\Tar2754.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/1848-0-0x0000000000400000-0x0000000001097000-memory.dmp

    Filesize

    12.6MB

  • memory/1848-71-0x0000000000400000-0x0000000001097000-memory.dmp

    Filesize

    12.6MB