Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2024, 06:02

General

  • Target

    5c516539e6aa7d2ce2a111afe96adc85.exe

  • Size

    266KB

  • MD5

    5c516539e6aa7d2ce2a111afe96adc85

  • SHA1

    b30df0b33bec1fe8823a384adba635930562a811

  • SHA256

    d50158048869b5d6ff9cf8d5a50bd730e9b40d112cb6eff9f381b6e8bbc0ec95

  • SHA512

    cdb2d9b14e032654bb5da41c6e0ad7e07e4ab7a20321e922b02ca085ccb400106601616793039574cf05cd78c7583ba0cdd428c52f40c8a18f647a81671f5f2c

  • SSDEEP

    6144:fb9PFro5jwssrPBPZHj0D6kivBtcbBZFeE8Tzg4zI8gAhn+XghImCSQ:brzvzBxHID6l2JX8vgSITApImC3

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c516539e6aa7d2ce2a111afe96adc85.exe
    "C:\Users\Admin\AppData\Local\Temp\5c516539e6aa7d2ce2a111afe96adc85.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Users\Admin\AppData\Local\Temp\5c516539e6aa7d2ce2a111afe96adc85.exe
      C:\Users\Admin\AppData\Local\Temp\5c516539e6aa7d2ce2a111afe96adc85.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\5c516539e6aa7d2ce2a111afe96adc85.exe

    Filesize

    266KB

    MD5

    ea4c4c6fd13f4eb5313bc123b7736043

    SHA1

    e8ac54e4efed17d58683f300719db49cc3045049

    SHA256

    fb702a0bb9a0d5ef3898c532b9c5dd492baecfcbf0856291ad5e7e80870cc152

    SHA512

    523b6ccf7cf91aa272d6e3ac39e3c284fca4e6a8c0b66cf4b66115d18d4de5b10679f136941d97fd8539d7fbe8ada63bc8c8d248abf2918cfe3345e1ae29f86b

  • memory/2796-17-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2796-19-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2796-42-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2992-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2992-1-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2992-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2992-13-0x00000000001A0000-0x0000000000226000-memory.dmp

    Filesize

    536KB

  • memory/2992-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB