Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2024, 07:07

General

  • Target

    88e08d2ea65b67e0887fbc3cd528a675.exe

  • Size

    4.4MB

  • MD5

    88e08d2ea65b67e0887fbc3cd528a675

  • SHA1

    c122e9c54aff1bc53b123161ec0c068ab2de8434

  • SHA256

    c48966c086bd96f08086b25818b02275aec8c65623526ea4b0aabf79b527f8e7

  • SHA512

    219fa35aca7d935497d1489fd30133e04e92b5f8fb032a174e135f74d0ca8d42a7fc7c708a408094efa54f5ebf75829aa3b253811f5fef45f818325b827b9c2f

  • SSDEEP

    98304:+BPyrSVIqI+zH4HBUCcqFp1HK3UT4NT4HBUCcg:+ZyrSG+0WC/f1q3ULWCX

Malware Config

Extracted

Family

gozi

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\88e08d2ea65b67e0887fbc3cd528a675.exe
    "C:\Users\Admin\AppData\Local\Temp\88e08d2ea65b67e0887fbc3cd528a675.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Users\Admin\AppData\Local\Temp\88e08d2ea65b67e0887fbc3cd528a675.exe
      C:\Users\Admin\AppData\Local\Temp\88e08d2ea65b67e0887fbc3cd528a675.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\88e08d2ea65b67e0887fbc3cd528a675.exe

    Filesize

    1024KB

    MD5

    954b70ae1625fcbe983967fa02af301f

    SHA1

    f6d00d9c38aeac9cfcac04df68e5050f11b0e3fc

    SHA256

    5f55ee50b6b354789428fa21904010f03f413f3512481399287b9405edf527d8

    SHA512

    4b031eeaf5896af95e5b5c7c9f5489c144ef9f5b4a2da7a71b69716729416408647c3bf9a88ee3b1d378e890a5e6a4825aba051aac0d7ef3ca8c8122335d59ea

  • \Users\Admin\AppData\Local\Temp\88e08d2ea65b67e0887fbc3cd528a675.exe

    Filesize

    4.4MB

    MD5

    4499be1deec0e3ffe73b2cb494ac1acd

    SHA1

    2a4a199165c25aa0a5a65649c1df655f30cda99e

    SHA256

    9e99954e26e0f75f3ed6c8d391ef1751d24ca4a2c3070ff03fd0011741b9e0ce

    SHA512

    909aa8bf6c07bd3c6ade2ac11eaf16ba921a2df8bd8e5805efdfa8a05707204db4e26c966ab9b5e50fb39d2e8fa5122e17aa4aa66b23ec11d916e8b4c06d4a2d

  • memory/1932-3-0x0000000000130000-0x0000000000263000-memory.dmp

    Filesize

    1.2MB

  • memory/1932-0-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/1932-15-0x0000000003AB0000-0x0000000003F9F000-memory.dmp

    Filesize

    4.9MB

  • memory/1932-13-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/1932-1-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/1932-31-0x0000000003AB0000-0x0000000003F9F000-memory.dmp

    Filesize

    4.9MB

  • memory/2376-16-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/2376-17-0x0000000001B20000-0x0000000001C53000-memory.dmp

    Filesize

    1.2MB

  • memory/2376-18-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/2376-23-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

  • memory/2376-24-0x00000000035A0000-0x00000000037CA000-memory.dmp

    Filesize

    2.2MB

  • memory/2376-32-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB