Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    10/01/2024, 16:13

General

  • Target

    0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe

  • Size

    536KB

  • MD5

    a831fd292adec253ceb03089ae56e1aa

  • SHA1

    1b13b93e1baa4be6813a2001ca75276891e07a48

  • SHA256

    0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe

  • SHA512

    cecd1ed8872a384342b8fb88d0e456ef013ee0f8aa364c0ca82735626e638aa111c10bf4b138c0128f34eb71fb203f722a6327d12d1d06846ea11754e24b625f

  • SSDEEP

    12288:lhf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:ldQyDLzJTveuK0/Okx2LF

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 4 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in Windows directory 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe
      "C:\Users\Admin\AppData\Local\Temp\0cdc51b0ae3ef491b1accd29f64167b498257de9a4d99e68a127caf06cbb4cbe.exe"
      2⤵
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0b481b7ed61544b11790517bca2d7aa7

    SHA1

    8d71c55c8047d6df675a4016d1705f12f7bfdbed

    SHA256

    918c046079e8c1b44b93eecd1139d56634f2a446e82b9048a851c7ee2471fd72

    SHA512

    49c9091b112221cf12cda30d5bb93b58549fde2ad773e137a8878e16971c621388990d9140bde5a8118cbc2abf7c6589cf99a203088897da4b3a9fe3230ad7cb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    359e1c9558f3ff196ff374c1a35bb761

    SHA1

    39a76b7291f7229e59e1ee6bff27bcb04065d757

    SHA256

    683bb47ed94ab5df2937939e821868df142d024ef41ac151dbed5f0b83c0e67f

    SHA512

    a87a1079b94d4408492dd65e29bbcb1d3b6b7a2ce5aa6194d8bc9c9bbdbc6df8172e3e04598f996c8fcfe089ca208bff944e0bccd00b1612b323efc952fa8ca5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5ca54a973e244731383baabdc250e272

    SHA1

    328739444d460e7f141ade7c0deb6d919794fae4

    SHA256

    43092f9834df0c05d3e33ae1d0b47e5033c7298923eeffba974674af1e69e60e

    SHA512

    2ce8bc861674fad4bae1386b7ba977384f7d585761f7fe0a6e4811a50c4ff5dbf33c9048682a87a828c19c0657954f0428962d3c9eb3c04b565530ec655c294f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9bed784df8712db632ea9a15a3dcefd6

    SHA1

    f1a42b138c3a2fe1e34b7fa4a0106712bf886abd

    SHA256

    5a8414b91d3af3f40d87e7eebf87f4a37fe058e21f4f1523fd5bd0979c67e7c9

    SHA512

    609b2874b59863a28ec28d5cd525cf9ea2be2eb2093934e80d8621ac680b17e2bfa91637191950413692c3d5289a7d796595b9912e45ddbb95dbce613b33bf43

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a9078de15d9b941112f5b92d27995df5

    SHA1

    9e594b77f4a79a0a5defd4e40a0a1ad6bf3fe258

    SHA256

    58a57e139d8153ab359fa08d862981edf257ef5a24b28f4420c654727e1b1491

    SHA512

    cb33a0f34b41ae727c3e69a05053c6a1643b52b7e21d50d92221178baf1ae99fd78b116d954730149e74412125fff65e0eaee826eded13f7651e0571328ce5ae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    45dfbd8adb46996629df0d37e53f5c68

    SHA1

    4574fbab132fbcc937af5757999eb5a647ae4dd7

    SHA256

    5ec1a6d38a8fe960adb48a68a1d344f05aa2749b41dd69977485d49174f30fa4

    SHA512

    6b86c966a0ac0ff25eb7b882c8a88d27dd40fba2468b9b79aec6a308a5a8664338506cbb0ec1eb2fe4c41bd45f8b1a66c52eae5235a90abcb24882911edba682

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1883ad7678481dab26c93b182c9b48ed

    SHA1

    9d0b3d7b9028bfecb6f7fbb518486de52ee13a83

    SHA256

    27fdd44057a8567c0c040819fdb0c100f125b8b5ba245aa76b4602b50a388454

    SHA512

    38a66a510e148c2dedb4b7112817d071f7744e5c0457b19b7a03c7c1c7efb4e22778172696ab9b766659fad15b7cd23abcdc33fe9f8a6c6e9413471ace1f270a

  • C:\Users\Admin\AppData\Local\Temp\Cab78BB.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar78DD.tmp

    Filesize

    54KB

    MD5

    52a2e3844c8998400b4f45836fe68f22

    SHA1

    751f81a9271cc6d17c1c47b7f41369a1014d142e

    SHA256

    a5d5fcaf60c61b9c91ffb8507914a339a70aa9185d42e9afe86958df61a47725

    SHA512

    fb3dcf3bc0bf6f23bef7f932e1a3e15f46bb0a906e04500dccfec1625cb69ce4406bcebd29ad86af780cf03ba73d5b9f950832cd904c26fba49f6edf70eb0366

  • memory/1256-116-0x0000000003BD0000-0x0000000003C49000-memory.dmp

    Filesize

    484KB

  • memory/1256-4-0x00000000029F0000-0x00000000029F3000-memory.dmp

    Filesize

    12KB

  • memory/1256-6-0x0000000003BD0000-0x0000000003C49000-memory.dmp

    Filesize

    484KB

  • memory/1256-7-0x00000000029F0000-0x00000000029F3000-memory.dmp

    Filesize

    12KB

  • memory/1256-3-0x00000000029F0000-0x00000000029F3000-memory.dmp

    Filesize

    12KB

  • memory/2668-295-0x0000000001270000-0x0000000001372000-memory.dmp

    Filesize

    1.0MB

  • memory/2668-0-0x0000000001270000-0x0000000001372000-memory.dmp

    Filesize

    1.0MB

  • memory/2668-429-0x0000000001270000-0x0000000001372000-memory.dmp

    Filesize

    1.0MB

  • memory/2668-42-0x0000000001270000-0x0000000001372000-memory.dmp

    Filesize

    1.0MB

  • memory/2668-707-0x0000000001270000-0x0000000001372000-memory.dmp

    Filesize

    1.0MB

  • memory/2668-717-0x0000000001270000-0x0000000001372000-memory.dmp

    Filesize

    1.0MB