Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    18/01/2024, 21:21

General

  • Target

    660fd7a1825862522675ccdb3db49ba2.exe

  • Size

    266KB

  • MD5

    660fd7a1825862522675ccdb3db49ba2

  • SHA1

    b5142c7fdebc2726d9d3b29413290f6390e93713

  • SHA256

    80a6b561a4ad2b4bce0dd6e42cd2e8e3207a8d028e836479a4a97a899124f91f

  • SHA512

    04d2484424de5154f0b9b198b9349774f12fafe43c786f29118f8f1865510a31f17cd3e3dc6764d2f05dcedd17838c37d15d6a080b6c1892bb940217e383edd8

  • SSDEEP

    6144:klwTM8qrTeBvIBhMsu3MrV75M0Tw9CCx3XRiUl9PmQ:kz8caOblu3Y15xTeCCpd9T

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\660fd7a1825862522675ccdb3db49ba2.exe
    "C:\Users\Admin\AppData\Local\Temp\660fd7a1825862522675ccdb3db49ba2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Users\Admin\AppData\Local\Temp\660fd7a1825862522675ccdb3db49ba2.exe
      C:\Users\Admin\AppData\Local\Temp\660fd7a1825862522675ccdb3db49ba2.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\660fd7a1825862522675ccdb3db49ba2.exe

    Filesize

    266KB

    MD5

    1ff075e8f99ced2ca26e7a56fad87519

    SHA1

    5fe5b0387658ffb28e1c2af5a177df5801e91aea

    SHA256

    2cc1e004e39377a9c8b8f04a8bb8bdd2cec980d9b06b21b91794f0ca7ace4b28

    SHA512

    528f27880c4efde384adb290f3cf719bb6ca46350c33f73e47ef6b9fa48282e26a945d63142e7a9f98bf3e90d7788c81a9a055a15e314b073869d9e9a0726d49

  • memory/2928-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2928-1-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2928-8-0x00000000002F0000-0x0000000000311000-memory.dmp

    Filesize

    132KB

  • memory/2928-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2928-33-0x0000000002CC0000-0x0000000002D46000-memory.dmp

    Filesize

    536KB

  • memory/3064-16-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/3064-19-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/3064-34-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB