Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2024, 05:37

General

  • Target

    55a2b427564b1336a6b0045f3f057f5f.exe

  • Size

    133KB

  • MD5

    55a2b427564b1336a6b0045f3f057f5f

  • SHA1

    15c5f2b185e94a0257e5f99ef6885aad329858bf

  • SHA256

    8835997b22588e85d432a8cc2ebcbad6e087a20bae408a19b69b725ac9711d61

  • SHA512

    2995c6ea3fc5a253950c5e5e74bcd0e85ebef60b4a2a35537f64aeb9dd73553817c8c1253d7b78c2aa14ac51b52e9fd061d94732c733f7f02444cdbd8088a8bb

  • SSDEEP

    3072:eX89Cuh53J6xrxzKZRlhK8SXKc8smcO28Z+jhjzQ:W895a5q7sX8sm5+jhvQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\55a2b427564b1336a6b0045f3f057f5f.exe
    "C:\Users\Admin\AppData\Local\Temp\55a2b427564b1336a6b0045f3f057f5f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\55a2b427564b1336a6b0045f3f057f5f.exe
      C:\Users\Admin\AppData\Local\Temp\55a2b427564b1336a6b0045f3f057f5f.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\55a2b427564b1336a6b0045f3f057f5f.exe

    Filesize

    133KB

    MD5

    779a6368a7b57d07078915bdfa77c1c0

    SHA1

    6c99a639d9aaf65de4c50d3fb3a0bc80ae5e2c8c

    SHA256

    4de9b76ea4714d596e0492bbcd9b001d718308857c8c53fe3f1423552f86f70b

    SHA512

    23c1730bb4af806913c10f4d063b1a6618799a365d968a4247305251f7ef343dc41ed051526bf2ad0827248ef9234157fd0c989d832aceaa0e2db0dfd32641d3

  • \Users\Admin\AppData\Local\Temp\55a2b427564b1336a6b0045f3f057f5f.exe

    Filesize

    128KB

    MD5

    9db6be3fffa02fc4ad6b51f2e8892494

    SHA1

    b85f11f2ac0601f4f6bff398baeefc71db8b7b97

    SHA256

    6c6d51c804a1cb6e0860309434c27f8d045700d097353db50433df598ae9b614

    SHA512

    63d5add5c18aee6d01f992b4628714024ef317ed7ad7d00b5ad538d83925bddefdad993f36120eb1574ca79841b74effaee98f0332dbe761e2743e5d0742cf1f

  • memory/2000-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2000-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2000-1-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2000-13-0x0000000000260000-0x00000000002E6000-memory.dmp

    Filesize

    536KB

  • memory/2000-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2904-20-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2904-42-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB