Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2024, 21:14

General

  • Target

    7e05713cb251fab0b4e3553188ffb1f2.exe

  • Size

    133KB

  • MD5

    7e05713cb251fab0b4e3553188ffb1f2

  • SHA1

    1642057f2c89caa68716252ddf67534dd998a754

  • SHA256

    650ee433f8212c7eb951376aca1c8e5387650f39786ec2c14ca8574ab669d5ea

  • SHA512

    49fe6193d11de261e760babf9c6479c22c0abeb02030077f1b1b655464cb52537a115bf19a4051389cb7d908dd720d924cf70497fc5f88196518ac6e4bcd9404

  • SSDEEP

    3072:ZzYBsqw8n/0O7aHu7rw/LUQR0M1e9B05DUar7yQ:1ysqw28WaO1CN8Bh0mQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e05713cb251fab0b4e3553188ffb1f2.exe
    "C:\Users\Admin\AppData\Local\Temp\7e05713cb251fab0b4e3553188ffb1f2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\7e05713cb251fab0b4e3553188ffb1f2.exe
      C:\Users\Admin\AppData\Local\Temp\7e05713cb251fab0b4e3553188ffb1f2.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\7e05713cb251fab0b4e3553188ffb1f2.exe

    Filesize

    133KB

    MD5

    051f30dbae51f93666624528bf34b682

    SHA1

    712f6b30a7772dbeedd104ecd56b682dcaccb161

    SHA256

    b0b3b67caa5bbb4e2c0977b6798d58cf225ccba178a7c03c8c0c073fa9410041

    SHA512

    f6880752bd7882673a27d9fdc18099197c80169d19fe08373a384485c8d83ec06d8d51783d4b8dc1e33d2b5760029f10ecca7010d3b2f498d2e72bf7c5923d2a

  • memory/1520-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1520-1-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1520-10-0x00000000002F0000-0x0000000000311000-memory.dmp

    Filesize

    132KB

  • memory/1520-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1520-14-0x0000000000320000-0x00000000003A6000-memory.dmp

    Filesize

    536KB

  • memory/1520-43-0x0000000000320000-0x00000000003A6000-memory.dmp

    Filesize

    536KB

  • memory/2652-18-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2652-20-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2652-44-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB