Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 12:44
Behavioral task
behavioral1
Sample
7a49d64aa6e4e6ad6f6278a906923c93.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7a49d64aa6e4e6ad6f6278a906923c93.exe
Resource
win10v2004-20231215-en
General
-
Target
7a49d64aa6e4e6ad6f6278a906923c93.exe
-
Size
133KB
-
MD5
7a49d64aa6e4e6ad6f6278a906923c93
-
SHA1
958146869ffcebd83f7dfe39a1e4e042fe928f87
-
SHA256
1313bdd5791248869656803b881c1cae81b88232fdf8bad983f864870e921c8e
-
SHA512
6212b4d9d15097eafc7d328e87b770bf421cc719bc7f88fe4eb540d5dbce892818c91c7dca12375cd282eb6e4792cb3183ef2f6afd1e9c29d0fad4c1675b2013
-
SSDEEP
3072:aQ5itg7BtttffJtAiID3M8O7+8LXka3aO4LaJBIwvffdYptivktnQ:aQEtg7/tZJeiITZqXLKfuBIwvfW+vMnQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2912 7a49d64aa6e4e6ad6f6278a906923c93.exe -
Executes dropped EXE 1 IoCs
pid Process 2912 7a49d64aa6e4e6ad6f6278a906923c93.exe -
Loads dropped DLL 1 IoCs
pid Process 2416 7a49d64aa6e4e6ad6f6278a906923c93.exe -
resource yara_rule behavioral1/memory/2416-0-0x0000000000400000-0x0000000000486000-memory.dmp upx behavioral1/files/0x000c0000000133b0-11.dat upx behavioral1/files/0x000c0000000133b0-14.dat upx behavioral1/files/0x000c0000000133b0-13.dat upx -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 7a49d64aa6e4e6ad6f6278a906923c93.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 7a49d64aa6e4e6ad6f6278a906923c93.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 7a49d64aa6e4e6ad6f6278a906923c93.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 7a49d64aa6e4e6ad6f6278a906923c93.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2416 7a49d64aa6e4e6ad6f6278a906923c93.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2416 7a49d64aa6e4e6ad6f6278a906923c93.exe 2912 7a49d64aa6e4e6ad6f6278a906923c93.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2912 2416 7a49d64aa6e4e6ad6f6278a906923c93.exe 16 PID 2416 wrote to memory of 2912 2416 7a49d64aa6e4e6ad6f6278a906923c93.exe 16 PID 2416 wrote to memory of 2912 2416 7a49d64aa6e4e6ad6f6278a906923c93.exe 16 PID 2416 wrote to memory of 2912 2416 7a49d64aa6e4e6ad6f6278a906923c93.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a49d64aa6e4e6ad6f6278a906923c93.exeC:\Users\Admin\AppData\Local\Temp\7a49d64aa6e4e6ad6f6278a906923c93.exe1⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
PID:2912
-
C:\Users\Admin\AppData\Local\Temp\7a49d64aa6e4e6ad6f6278a906923c93.exe"C:\Users\Admin\AppData\Local\Temp\7a49d64aa6e4e6ad6f6278a906923c93.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5f55d59ab378f6c1780da1b5260406f55
SHA149f23e24366712271bfea41867234d74decbc6cc
SHA256386c54fdee44cbe7a490066a086155ed83dc3da10fbbec36910c73abcbe44847
SHA512e6bcb57aa5db5463c77c5b0d5e7647385ccfe0cb13333517808e8c3598bdcf95470924dbf602c8057d41b76afae8879442a9c4087a1a4ba518f7d06db4892cbc
-
Filesize
90KB
MD5eec43a630e83fa3a65b2e69dbc9213cb
SHA176db5072bd35fb39e9dcefef40030825ad99e3a8
SHA25655770f1b23d285dd742e21ea76609d4889aa4a3b773cb8b61ac628381f4bd763
SHA512b38299cf663af300783bf0d29b3fcc123405286777df5a47099c0a671366425be848b5bea054b398380c4785411bc8e57ffedf1ec28bbcec12be141a6ec3a825
-
Filesize
124KB
MD50877e897f73d611e9624f3dc63c5f901
SHA10db0ee798da67d003054a41096ccf8a34800887e
SHA256cb24e694a3246681c945b97320d4d35bdf4eb628d74f831471f72b5085842e6e
SHA5124ee378e13c16f41ea81b0e0a5b7a2bca70a0a49429644047079a67cfea0732c49597940ccc83315af576c7d2b782fc5215fbb001cbffbf9230ce4c8f8203430e