Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 03:21

General

  • Target

    8b436697546c55affeca4d296a94d865.exe

  • Size

    133KB

  • MD5

    8b436697546c55affeca4d296a94d865

  • SHA1

    f17670507c187d9ec295d8e1a7ded1fde37344c8

  • SHA256

    40a4a40ce20b2cc166f429b0a16dac5757e15952a2580f14034a11448251040b

  • SHA512

    64e286aef800e551ead85230659b44bd34a5b0aa79cdcd6573d594ee25238a874c16f1bca53c96f6439dd0326cc66b430d62c57a44f7176f1f7d8e2e267a6b14

  • SSDEEP

    3072:l6Byi2HgHcQ6GG4fxMxoOFXZHzGKg7AjQSZdKzWZoQ:l6By1gHcJ0ooKX1GKgMjQSZdKzEoQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b436697546c55affeca4d296a94d865.exe
    C:\Users\Admin\AppData\Local\Temp\8b436697546c55affeca4d296a94d865.exe
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies system certificate store
    • Suspicious use of UnmapMainImage
    PID:2376
  • C:\Users\Admin\AppData\Local\Temp\8b436697546c55affeca4d296a94d865.exe
    "C:\Users\Admin\AppData\Local\Temp\8b436697546c55affeca4d296a94d865.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\8b436697546c55affeca4d296a94d865.exe

    Filesize

    133KB

    MD5

    a875943fc61e52c672c854a0c4e74f55

    SHA1

    6b2a60152d63180bef0b6eba548e84382552e7c3

    SHA256

    5bdd49dc366d42352d6301bce7543720665234fdc4226adec73d9cee224382c8

    SHA512

    960d175e17eedb5904c16c5b1f0464e9248367665837de41840c455b5d9d3343f9fd7e1acc4658e3561e1464ca0e11b513044e941acdac107d18c095a04f03ff

  • memory/2212-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2212-5-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2212-7-0x00000000002F0000-0x0000000000311000-memory.dmp

    Filesize

    132KB

  • memory/2212-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2212-14-0x0000000000320000-0x00000000003A6000-memory.dmp

    Filesize

    536KB

  • memory/2212-43-0x0000000000320000-0x00000000003A6000-memory.dmp

    Filesize

    536KB

  • memory/2376-18-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2376-20-0x00000000001E0000-0x0000000000201000-memory.dmp

    Filesize

    132KB

  • memory/2376-44-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB