Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2024, 12:44

General

  • Target

    7a49d64aa6e4e6ad6f6278a906923c93.exe

  • Size

    133KB

  • MD5

    7a49d64aa6e4e6ad6f6278a906923c93

  • SHA1

    958146869ffcebd83f7dfe39a1e4e042fe928f87

  • SHA256

    1313bdd5791248869656803b881c1cae81b88232fdf8bad983f864870e921c8e

  • SHA512

    6212b4d9d15097eafc7d328e87b770bf421cc719bc7f88fe4eb540d5dbce892818c91c7dca12375cd282eb6e4792cb3183ef2f6afd1e9c29d0fad4c1675b2013

  • SSDEEP

    3072:aQ5itg7BtttffJtAiID3M8O7+8LXka3aO4LaJBIwvffdYptivktnQ:aQEtg7/tZJeiITZqXLKfuBIwvfW+vMnQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a49d64aa6e4e6ad6f6278a906923c93.exe
    C:\Users\Admin\AppData\Local\Temp\7a49d64aa6e4e6ad6f6278a906923c93.exe
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies system certificate store
    • Suspicious use of UnmapMainImage
    PID:2912
  • C:\Users\Admin\AppData\Local\Temp\7a49d64aa6e4e6ad6f6278a906923c93.exe
    "C:\Users\Admin\AppData\Local\Temp\7a49d64aa6e4e6ad6f6278a906923c93.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7a49d64aa6e4e6ad6f6278a906923c93.exe

    Filesize

    19KB

    MD5

    f55d59ab378f6c1780da1b5260406f55

    SHA1

    49f23e24366712271bfea41867234d74decbc6cc

    SHA256

    386c54fdee44cbe7a490066a086155ed83dc3da10fbbec36910c73abcbe44847

    SHA512

    e6bcb57aa5db5463c77c5b0d5e7647385ccfe0cb13333517808e8c3598bdcf95470924dbf602c8057d41b76afae8879442a9c4087a1a4ba518f7d06db4892cbc

  • C:\Users\Admin\AppData\Local\Temp\7a49d64aa6e4e6ad6f6278a906923c93.exe

    Filesize

    90KB

    MD5

    eec43a630e83fa3a65b2e69dbc9213cb

    SHA1

    76db5072bd35fb39e9dcefef40030825ad99e3a8

    SHA256

    55770f1b23d285dd742e21ea76609d4889aa4a3b773cb8b61ac628381f4bd763

    SHA512

    b38299cf663af300783bf0d29b3fcc123405286777df5a47099c0a671366425be848b5bea054b398380c4785411bc8e57ffedf1ec28bbcec12be141a6ec3a825

  • \Users\Admin\AppData\Local\Temp\7a49d64aa6e4e6ad6f6278a906923c93.exe

    Filesize

    124KB

    MD5

    0877e897f73d611e9624f3dc63c5f901

    SHA1

    0db0ee798da67d003054a41096ccf8a34800887e

    SHA256

    cb24e694a3246681c945b97320d4d35bdf4eb628d74f831471f72b5085842e6e

    SHA512

    4ee378e13c16f41ea81b0e0a5b7a2bca70a0a49429644047079a67cfea0732c49597940ccc83315af576c7d2b782fc5215fbb001cbffbf9230ce4c8f8203430e

  • memory/2416-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2416-10-0x00000000002D0000-0x00000000002F1000-memory.dmp

    Filesize

    132KB

  • memory/2416-1-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2416-16-0x0000000000310000-0x0000000000396000-memory.dmp

    Filesize

    536KB

  • memory/2416-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2912-18-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2912-20-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2912-34-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB