Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/02/2024, 23:48
Behavioral task
behavioral1
Sample
95b05d07387d37665d747ebc037441fc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
95b05d07387d37665d747ebc037441fc.exe
Resource
win10v2004-20231222-en
General
-
Target
95b05d07387d37665d747ebc037441fc.exe
-
Size
1.6MB
-
MD5
95b05d07387d37665d747ebc037441fc
-
SHA1
ddfcc624ab19687b7f973df79446e65e1757af49
-
SHA256
99c04d2dc579bd0dc8580eb8689ed63bf56ddd11d57369f1d5c4cb84e7f0738a
-
SHA512
a5c011737019282c99bd0d1a31f7423437cf89f8ad27f8fbff9c01b79f7f757dfa4a8933a0dd7f3c591720749747ff161f91539cabc4d208d79ecee71a4ed0df
-
SSDEEP
49152:fYUSQrXtWqcakLz0JCg+MoECUiWcakLz0O:fhSQjtWqcakcJCg+MoFUiWcakcO
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2680 95b05d07387d37665d747ebc037441fc.exe -
Executes dropped EXE 1 IoCs
pid Process 2680 95b05d07387d37665d747ebc037441fc.exe -
Loads dropped DLL 1 IoCs
pid Process 2016 95b05d07387d37665d747ebc037441fc.exe -
resource yara_rule behavioral1/memory/2016-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/files/0x000d00000001225c-13.dat upx behavioral1/memory/2680-17-0x0000000000400000-0x000000000065C000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 2 pastebin.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2808 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 95b05d07387d37665d747ebc037441fc.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 95b05d07387d37665d747ebc037441fc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 95b05d07387d37665d747ebc037441fc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 95b05d07387d37665d747ebc037441fc.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2016 95b05d07387d37665d747ebc037441fc.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2016 95b05d07387d37665d747ebc037441fc.exe 2680 95b05d07387d37665d747ebc037441fc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2680 2016 95b05d07387d37665d747ebc037441fc.exe 29 PID 2016 wrote to memory of 2680 2016 95b05d07387d37665d747ebc037441fc.exe 29 PID 2016 wrote to memory of 2680 2016 95b05d07387d37665d747ebc037441fc.exe 29 PID 2016 wrote to memory of 2680 2016 95b05d07387d37665d747ebc037441fc.exe 29 PID 2680 wrote to memory of 2808 2680 95b05d07387d37665d747ebc037441fc.exe 30 PID 2680 wrote to memory of 2808 2680 95b05d07387d37665d747ebc037441fc.exe 30 PID 2680 wrote to memory of 2808 2680 95b05d07387d37665d747ebc037441fc.exe 30 PID 2680 wrote to memory of 2808 2680 95b05d07387d37665d747ebc037441fc.exe 30 PID 2680 wrote to memory of 2888 2680 95b05d07387d37665d747ebc037441fc.exe 32 PID 2680 wrote to memory of 2888 2680 95b05d07387d37665d747ebc037441fc.exe 32 PID 2680 wrote to memory of 2888 2680 95b05d07387d37665d747ebc037441fc.exe 32 PID 2680 wrote to memory of 2888 2680 95b05d07387d37665d747ebc037441fc.exe 32 PID 2888 wrote to memory of 2584 2888 cmd.exe 34 PID 2888 wrote to memory of 2584 2888 cmd.exe 34 PID 2888 wrote to memory of 2584 2888 cmd.exe 34 PID 2888 wrote to memory of 2584 2888 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\95b05d07387d37665d747ebc037441fc.exe"C:\Users\Admin\AppData\Local\Temp\95b05d07387d37665d747ebc037441fc.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\95b05d07387d37665d747ebc037441fc.exeC:\Users\Admin\AppData\Local\Temp\95b05d07387d37665d747ebc037441fc.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\95b05d07387d37665d747ebc037441fc.exe" /TN U5Z8sQiHf24d /F3⤵
- Creates scheduled task(s)
PID:2808
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN U5Z8sQiHf24d > C:\Users\Admin\AppData\Local\Temp\fTLBaDb.xml3⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN U5Z8sQiHf24d4⤵PID:2584
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD515e6b9e496a2c2987aebfe2bb3eb3d90
SHA1c05378306d8211f06d8a8e8ee6a2495bbdc57ce9
SHA25664fa3841e8fd2206457d84bf9d8ebd392186e0f9f1d06459152af2ad16547cdd
SHA512614ef7a38ab40fb07b10146bcdafe11bd5d0c107965f81d0e8fa4af7b7f333465a39b522a9ac217cdd10fe858e4eb87b41002ac57e00e38570e60359e8cac341
-
Filesize
1KB
MD5f0fc2e054c9790293703d0efe9974f9f
SHA186ae0b165a6da4cc11d599c4761c7e037ae5e4a4
SHA2560627cee48838177b976cab28a8902755436ae106e216f747702c5c5f77ddc63e
SHA5122791f10b1ebd6bf7f96299f9a820626b3c6308ed11db69d4ee98873b84e261df5cac3cd0dfe1d97047fb90e9fbb116ab82b772f1b7e3166b622aa8763a4dffe4