Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 18:59
Behavioral task
behavioral1
Sample
5159c99a2dfbd41653643333a5a6aa35.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5159c99a2dfbd41653643333a5a6aa35.exe
Resource
win10v2004-20231215-en
General
-
Target
5159c99a2dfbd41653643333a5a6aa35.exe
-
Size
5.1MB
-
MD5
5159c99a2dfbd41653643333a5a6aa35
-
SHA1
0b7594d82d0c04629211992f7ecbee31a39f2c16
-
SHA256
8c62b4fa60439a0ae04a6d022b1d17278cdd97701b10aa926f0802c007703261
-
SHA512
ab3a42268e27a7f962f981ccb06a58ce79661bd58e4ce6ed1898b220c0aafb3f8f7f8c254ed322a424651e298d4da3c727e936b49c2e0d2788e4380e434c78d5
-
SSDEEP
49152:1JBZ7tti1Or0fI/oGphMqHvvE5V3m02HIuDiMDfdQVc+OqDay3r0g5CUb/WQWUW5:1JBMwnHntDZzV+N3oWCUbu7ZeU3
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3036 5159c99a2dfbd41653643333a5a6aa35.exe -
Executes dropped EXE 1 IoCs
pid Process 3036 5159c99a2dfbd41653643333a5a6aa35.exe -
Loads dropped DLL 1 IoCs
pid Process 1792 5159c99a2dfbd41653643333a5a6aa35.exe -
resource yara_rule behavioral1/memory/1792-1-0x0000000000400000-0x0000000000D9E000-memory.dmp upx behavioral1/files/0x000d000000012246-11.dat upx behavioral1/files/0x000d000000012246-14.dat upx behavioral1/files/0x000d000000012246-13.dat upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 5159c99a2dfbd41653643333a5a6aa35.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 5159c99a2dfbd41653643333a5a6aa35.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 5159c99a2dfbd41653643333a5a6aa35.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 5159c99a2dfbd41653643333a5a6aa35.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1792 5159c99a2dfbd41653643333a5a6aa35.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1792 5159c99a2dfbd41653643333a5a6aa35.exe 3036 5159c99a2dfbd41653643333a5a6aa35.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1792 wrote to memory of 3036 1792 5159c99a2dfbd41653643333a5a6aa35.exe 28 PID 1792 wrote to memory of 3036 1792 5159c99a2dfbd41653643333a5a6aa35.exe 28 PID 1792 wrote to memory of 3036 1792 5159c99a2dfbd41653643333a5a6aa35.exe 28 PID 1792 wrote to memory of 3036 1792 5159c99a2dfbd41653643333a5a6aa35.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\5159c99a2dfbd41653643333a5a6aa35.exe"C:\Users\Admin\AppData\Local\Temp\5159c99a2dfbd41653643333a5a6aa35.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\5159c99a2dfbd41653643333a5a6aa35.exeC:\Users\Admin\AppData\Local\Temp\5159c99a2dfbd41653643333a5a6aa35.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342KB
MD5fecb96e06c19aa49fc3622de66cb447d
SHA192fa2a53af02b0320c9de980a05a2332bf303205
SHA2565465c878dc6b80d40cac05e4eb8729dac3f1597c99e7feaae8783ed72f026cea
SHA512ee78c9f8d66081deddc6fee78d01e0f297a32c9a83a423b70112eff86e1b9f8f2cda3278188bf55d2d9910e5c23930695b5cc802bf7c0270838d66bcfc058376
-
Filesize
92KB
MD51b5ba5e5a2bde9eb3f6befc5b8049d82
SHA17a20bbe9cc9cac40ec2ed069fe1c3b6057d58596
SHA256033971b7694e73147dff4c027172876dc46cb60569011568b024dd84193396a0
SHA51255ad58e33012e678942912afb9dc02dec15db64dce7bd6a1e37c8db2e2f80ee0987c81bb4edfb8c6d3048092d50dd2bb029d20516f5c82c6f155689dcd1f83cb
-
Filesize
894KB
MD55e7b499e85101eb1b15e387ea4a13861
SHA11fc73121d463ba9b466d5689c94e6a54914c396a
SHA256352a240b32598af4b2734b44bea9ba6b67343d685559eac24996babe38bc86aa
SHA51206041380dfd4b9d79df63898ef948c34b695756921abc69a6cace3ecead8cece48a0e4c9a64148c661a6d274ab9e05159a0c70b520e9f51e946949459c87dabf