Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2024, 02:31

General

  • Target

    713687ccb1d16ec1246b6073ec26d277.exe

  • Size

    133KB

  • MD5

    713687ccb1d16ec1246b6073ec26d277

  • SHA1

    101ead41a2dca628c3580110c00a2f02ff6db304

  • SHA256

    72ce4eb913caeabc5dce5fbf461157431e11d942856c3cef89849521cb1b531c

  • SHA512

    6f72a4773a579836b13c5a2ea6ce912d084cf266e6fa9f69e855d1f5cf90d92524d0b09bbcc88c5cc8114fb947f89a8a886bc8135cb1f5d54db7d075d9d0aca0

  • SSDEEP

    3072:uCxKAwqMYxsZBOUJj/yq0bruGK7qpzeZhqndcFi3VdQhQ:FtExEqO4ZiMiohQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\713687ccb1d16ec1246b6073ec26d277.exe
    "C:\Users\Admin\AppData\Local\Temp\713687ccb1d16ec1246b6073ec26d277.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Users\Admin\AppData\Local\Temp\713687ccb1d16ec1246b6073ec26d277.exe
      C:\Users\Admin\AppData\Local\Temp\713687ccb1d16ec1246b6073ec26d277.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\713687ccb1d16ec1246b6073ec26d277.exe

    Filesize

    133KB

    MD5

    7bdc3389c443b8f4c4aac4012f5ef61d

    SHA1

    e5a6860ab49f0d5769906cc4ea053a6018e78d97

    SHA256

    a538173cccfc79b7786902f425b50155bb187e64d48a6ecebfaaed23ffb4533b

    SHA512

    de823dc1e208df620412b266411ebafab7d7a26d9f28ea54d2464519aca79b2f2df9d2506e27b86c576e2a2269353bf292c90221ee4220cd802e3ee8e85ff96d

  • memory/2004-17-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2004-18-0x00000000001F0000-0x0000000000211000-memory.dmp

    Filesize

    132KB

  • memory/2004-43-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2152-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2152-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2152-1-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2152-15-0x0000000000290000-0x0000000000316000-memory.dmp

    Filesize

    536KB

  • memory/2152-14-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB