Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
7f4fc1d5a6c57db4a63e7f45f1612f8c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7f4fc1d5a6c57db4a63e7f45f1612f8c.exe
Resource
win10v2004-20231215-en
General
-
Target
7f4fc1d5a6c57db4a63e7f45f1612f8c.exe
-
Size
907KB
-
MD5
7f4fc1d5a6c57db4a63e7f45f1612f8c
-
SHA1
81254ccce5f9d767d04315dcbdda3aff36dac935
-
SHA256
aa1066322da98f5fe1a64b99010935cf42478fa1c2c27d4eef7d5099373c6721
-
SHA512
45731924f3a401dd816bae3dc4367af661d49c0ff164e48a647ede966181f1322ea57e6197a5b22290c4416464d1e8cc406078f95c74edea522b6bd49a48d9b0
-
SSDEEP
24576:Uut9edhaOIfwGE008eQtGnhJnv0+qRa/ZS1:U+odhCYGE00yQnbnbqgS
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2820 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe -
Executes dropped EXE 1 IoCs
pid Process 2820 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe -
Loads dropped DLL 1 IoCs
pid Process 1224 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 pastebin.com 4 pastebin.com -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1224 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1224 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe 2820 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1224 wrote to memory of 2820 1224 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe 29 PID 1224 wrote to memory of 2820 1224 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe 29 PID 1224 wrote to memory of 2820 1224 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe 29 PID 1224 wrote to memory of 2820 1224 7f4fc1d5a6c57db4a63e7f45f1612f8c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f4fc1d5a6c57db4a63e7f45f1612f8c.exe"C:\Users\Admin\AppData\Local\Temp\7f4fc1d5a6c57db4a63e7f45f1612f8c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\7f4fc1d5a6c57db4a63e7f45f1612f8c.exeC:\Users\Admin\AppData\Local\Temp\7f4fc1d5a6c57db4a63e7f45f1612f8c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
273KB
MD514d6a54115d138b5ee0dcbed9f912cfc
SHA1bd1e42ffb6399d1278eef7f193fd949b4acdc42a
SHA25680396840d1b8c36996cd430b793554c943baf98d705225fb0fd6e9862903e352
SHA5128c0c13dc95e58bc99d2189f04643ba5cf6fe3e79147f9c9b7008b8b0077d52eb753554446833d7a4f0917fd28a27ffac713376679517ffba862098768ab4778d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
184KB
MD56d83f2301153c035a040c47959b4794f
SHA1a21b556d0350fed2dcab99a2840e45eceee3e608
SHA2565ee32103a4f975d525d9aa888cf8715303be5617554b2132ed4d20a8937d3cc0
SHA512a28091ee93d9ddab61f18b637f8412263f4c4b3a71768398b7c7158dcb6e3cb6a31e4c1589d39481b72eb60603504025e5253c1a05254fe4a408bcec1c6ba759