Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
17/01/2024, 23:53
Behavioral task
behavioral1
Sample
63f11d7bef9ed55da42911d406f91412.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
63f11d7bef9ed55da42911d406f91412.exe
Resource
win10v2004-20231222-en
General
-
Target
63f11d7bef9ed55da42911d406f91412.exe
-
Size
3.9MB
-
MD5
63f11d7bef9ed55da42911d406f91412
-
SHA1
3e6a3d7fb598a18f2db9c965040a8b34e588fe3a
-
SHA256
20d0a838a1bb70e9cb849f304b2831e1eba3e065ebe32677268fa821630cf7d2
-
SHA512
385530dfe5c051783dcdbe26e3590f68385f5c2a680ed48ec016803be319f0db6504e61633799ed35cc6b30527c6722f445032396118b89434417f4c3154ae96
-
SSDEEP
98304:rmWXJgrGm7+pUJcakcibiqhMbMgOn7n0bcakcibiqhxe64MhRirLccakcibiqhM:iCJgymkUJdlirybMgOnkdlir2LMbicdK
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2180 63f11d7bef9ed55da42911d406f91412.exe -
Executes dropped EXE 1 IoCs
pid Process 2180 63f11d7bef9ed55da42911d406f91412.exe -
Loads dropped DLL 1 IoCs
pid Process 2528 63f11d7bef9ed55da42911d406f91412.exe -
resource yara_rule behavioral1/memory/2528-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/files/0x00070000000120ff-11.dat upx behavioral1/memory/2528-16-0x0000000023610000-0x000000002386C000-memory.dmp upx behavioral1/files/0x00070000000120ff-17.dat upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2868 schtasks.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 63f11d7bef9ed55da42911d406f91412.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 63f11d7bef9ed55da42911d406f91412.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 63f11d7bef9ed55da42911d406f91412.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 63f11d7bef9ed55da42911d406f91412.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2528 63f11d7bef9ed55da42911d406f91412.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2528 63f11d7bef9ed55da42911d406f91412.exe 2180 63f11d7bef9ed55da42911d406f91412.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2180 2528 63f11d7bef9ed55da42911d406f91412.exe 29 PID 2528 wrote to memory of 2180 2528 63f11d7bef9ed55da42911d406f91412.exe 29 PID 2528 wrote to memory of 2180 2528 63f11d7bef9ed55da42911d406f91412.exe 29 PID 2528 wrote to memory of 2180 2528 63f11d7bef9ed55da42911d406f91412.exe 29 PID 2180 wrote to memory of 2868 2180 63f11d7bef9ed55da42911d406f91412.exe 30 PID 2180 wrote to memory of 2868 2180 63f11d7bef9ed55da42911d406f91412.exe 30 PID 2180 wrote to memory of 2868 2180 63f11d7bef9ed55da42911d406f91412.exe 30 PID 2180 wrote to memory of 2868 2180 63f11d7bef9ed55da42911d406f91412.exe 30 PID 2180 wrote to memory of 2276 2180 63f11d7bef9ed55da42911d406f91412.exe 32 PID 2180 wrote to memory of 2276 2180 63f11d7bef9ed55da42911d406f91412.exe 32 PID 2180 wrote to memory of 2276 2180 63f11d7bef9ed55da42911d406f91412.exe 32 PID 2180 wrote to memory of 2276 2180 63f11d7bef9ed55da42911d406f91412.exe 32 PID 2276 wrote to memory of 2400 2276 cmd.exe 34 PID 2276 wrote to memory of 2400 2276 cmd.exe 34 PID 2276 wrote to memory of 2400 2276 cmd.exe 34 PID 2276 wrote to memory of 2400 2276 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\63f11d7bef9ed55da42911d406f91412.exe"C:\Users\Admin\AppData\Local\Temp\63f11d7bef9ed55da42911d406f91412.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\63f11d7bef9ed55da42911d406f91412.exeC:\Users\Admin\AppData\Local\Temp\63f11d7bef9ed55da42911d406f91412.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\63f11d7bef9ed55da42911d406f91412.exe" /TN m8v9k5kD0c8e /F3⤵
- Creates scheduled task(s)
PID:2868
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN m8v9k5kD0c8e > C:\Users\Admin\AppData\Local\Temp\NngVw.xml3⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN m8v9k5kD0c8e4⤵PID:2400
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5865d682223c5272b7af5c16881c9de86
SHA190482056812e222da057bc52587db58cff08894e
SHA256e5751c44f89a4f1d3d3094522ce60cfb07f051a43475010fe0a4259a1846b19c
SHA512609be8bb807ddabd70369d5480b2f9517f55dc49f828d7f71914778141abae653385b50b2f4e12595a0f1aa1800bd9a119b7611b23186f17402d1d8da8781aa4
-
Filesize
1KB
MD5da3b1adb741213d51bfabc1520b69c40
SHA1711e5bbb30eac955a3e3970c6d7cc75a66fa6843
SHA256ba186d4486ceb28a8745702a21fafc1a7da0b762e6cfb6cea6e66e6223c6f40e
SHA5121cce383cf8f5d639519040c2d5b9fb785f28422264fb49d819cae28fea92aace58a62c93deb6d341b9678f8e0a3484ec9a37a0df5e1abe5cf40adac09b99c46d
-
Filesize
2.1MB
MD5009128ff55a8c9ab2a9a5a4ec8097948
SHA1bf770c59cd21d401f1fcdcd70d6f72c1e4a65f68
SHA2561068028d779347cd3e79670881ba17c941020dddbc033e6e3a7eba712cbbddbc
SHA512e5fd36bd79c6320817684a24daf56fcc9be59a65d0f31e4db1f5cfe96d3d86b7c0d46969b4fe2aadcde9df950acf4914f62945d0c012a53cdf0a464510b48f1d