Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 15:06
Behavioral task
behavioral1
Sample
7d49f73681f8f0fbba9315f4ae02916b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7d49f73681f8f0fbba9315f4ae02916b.exe
Resource
win10v2004-20231215-en
General
-
Target
7d49f73681f8f0fbba9315f4ae02916b.exe
-
Size
821KB
-
MD5
7d49f73681f8f0fbba9315f4ae02916b
-
SHA1
d60460389295773336eff8d60213f35a48f06c17
-
SHA256
e08e88635a129122287e9c873c386b72d706d6639ad68e5de509bd842af46c8d
-
SHA512
5ed69b9d45eec8d0d8c3712e87b2e8d71d7fc48d93e76f738a3370d5a7fb32b85ba606e1c5b7e3aa4054fbe358c2a18905c1509e71f481cb1d7f492aa6f9dbd0
-
SSDEEP
12288:LsMYxhA9bm1D0WjZfYh/Qb/LUnKaR26mLQ16BpOWuoflO9dJ5IECpxOokLZsCtQ2:LADjsXKybqQ4OWuocjukL2CDYO
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1744 7d49f73681f8f0fbba9315f4ae02916b.exe -
Executes dropped EXE 1 IoCs
pid Process 1744 7d49f73681f8f0fbba9315f4ae02916b.exe -
Loads dropped DLL 1 IoCs
pid Process 2384 7d49f73681f8f0fbba9315f4ae02916b.exe -
resource yara_rule behavioral1/memory/2384-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/files/0x000b000000014534-11.dat upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 2 pastebin.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2560 schtasks.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 7d49f73681f8f0fbba9315f4ae02916b.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 7d49f73681f8f0fbba9315f4ae02916b.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 7d49f73681f8f0fbba9315f4ae02916b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 7d49f73681f8f0fbba9315f4ae02916b.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2384 7d49f73681f8f0fbba9315f4ae02916b.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2384 7d49f73681f8f0fbba9315f4ae02916b.exe 1744 7d49f73681f8f0fbba9315f4ae02916b.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2384 wrote to memory of 1744 2384 7d49f73681f8f0fbba9315f4ae02916b.exe 29 PID 2384 wrote to memory of 1744 2384 7d49f73681f8f0fbba9315f4ae02916b.exe 29 PID 2384 wrote to memory of 1744 2384 7d49f73681f8f0fbba9315f4ae02916b.exe 29 PID 2384 wrote to memory of 1744 2384 7d49f73681f8f0fbba9315f4ae02916b.exe 29 PID 1744 wrote to memory of 2560 1744 7d49f73681f8f0fbba9315f4ae02916b.exe 30 PID 1744 wrote to memory of 2560 1744 7d49f73681f8f0fbba9315f4ae02916b.exe 30 PID 1744 wrote to memory of 2560 1744 7d49f73681f8f0fbba9315f4ae02916b.exe 30 PID 1744 wrote to memory of 2560 1744 7d49f73681f8f0fbba9315f4ae02916b.exe 30 PID 1744 wrote to memory of 2676 1744 7d49f73681f8f0fbba9315f4ae02916b.exe 32 PID 1744 wrote to memory of 2676 1744 7d49f73681f8f0fbba9315f4ae02916b.exe 32 PID 1744 wrote to memory of 2676 1744 7d49f73681f8f0fbba9315f4ae02916b.exe 32 PID 1744 wrote to memory of 2676 1744 7d49f73681f8f0fbba9315f4ae02916b.exe 32 PID 2676 wrote to memory of 2660 2676 cmd.exe 34 PID 2676 wrote to memory of 2660 2676 cmd.exe 34 PID 2676 wrote to memory of 2660 2676 cmd.exe 34 PID 2676 wrote to memory of 2660 2676 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d49f73681f8f0fbba9315f4ae02916b.exe"C:\Users\Admin\AppData\Local\Temp\7d49f73681f8f0fbba9315f4ae02916b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\7d49f73681f8f0fbba9315f4ae02916b.exeC:\Users\Admin\AppData\Local\Temp\7d49f73681f8f0fbba9315f4ae02916b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\7d49f73681f8f0fbba9315f4ae02916b.exe" /TN qm2lmOfce5f6 /F3⤵
- Creates scheduled task(s)
PID:2560
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN qm2lmOfce5f6 > C:\Users\Admin\AppData\Local\Temp\nx5TNP3.xml3⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN qm2lmOfce5f64⤵PID:2660
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cd8c68059a35e94c494b2dc49aab26a2
SHA1cd67f93e6b3b578a4ca12b348f78b1cf0e0df2c0
SHA256f023ed76c4815d0203a94919f4f2f9a537ee5b07caf6110376f9b1976c4e4ae9
SHA512eb3596335504a425eeb9fc538f3a20a129dc1f33611d35247f01a667fbfedb77206e7134fa4aa063000a87b8a93ded88c75b3084551289d79a2051aacfde9064
-
Filesize
821KB
MD580c0c374d2047864b9f18f798e9cbc06
SHA1c69e2d3cc0236de378dfa9594cd38bf9b53e5f2a
SHA256e0f571ed13c91ba8e6e45905e8507f44a2d0949fd1812f303159a5f1c75697a6
SHA51277ae06c273702e5caf97ddd14059f8c7f41a531f5be25ef4761813b1082da3bf53678cffc02d95d6a2767424a34a881de8553c88193bf471b4dc148a3179c098