Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 12:23
Behavioral task
behavioral1
Sample
97250559ff9e569982b39dc250965ef2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
97250559ff9e569982b39dc250965ef2.exe
Resource
win10v2004-20231222-en
General
-
Target
97250559ff9e569982b39dc250965ef2.exe
-
Size
1003KB
-
MD5
97250559ff9e569982b39dc250965ef2
-
SHA1
2382de86791eed4392921c55873207497e23da4a
-
SHA256
d24d162ff74a47d8a0523eda22c2f3e942b87326ab359f6c5890dea3eacf0728
-
SHA512
a5d0449c3a947765f41566b903025419e67f39de6dcf33e0803078f97d875381a6e6bd48c83fe8949f0d9014119f44e893cfe659fbc3027bb7821e1a078a89b7
-
SSDEEP
24576:ipXP4gg07XQcA6Eg6uCNZEMHXtT1E1MGQoadai7D3uITjIFOxo53ApIj:ipXP4ggqXjA6Eg6FNZEMHXtT+1MGQ7aX
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2172 97250559ff9e569982b39dc250965ef2.exe -
Executes dropped EXE 1 IoCs
pid Process 2172 97250559ff9e569982b39dc250965ef2.exe -
Loads dropped DLL 1 IoCs
pid Process 2196 97250559ff9e569982b39dc250965ef2.exe -
resource yara_rule behavioral1/memory/2196-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/files/0x0009000000014abe-11.dat upx behavioral1/memory/2196-16-0x0000000022F00000-0x000000002315C000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 2 pastebin.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2560 schtasks.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 97250559ff9e569982b39dc250965ef2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 97250559ff9e569982b39dc250965ef2.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 97250559ff9e569982b39dc250965ef2.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 97250559ff9e569982b39dc250965ef2.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2196 97250559ff9e569982b39dc250965ef2.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2196 97250559ff9e569982b39dc250965ef2.exe 2172 97250559ff9e569982b39dc250965ef2.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2172 2196 97250559ff9e569982b39dc250965ef2.exe 29 PID 2196 wrote to memory of 2172 2196 97250559ff9e569982b39dc250965ef2.exe 29 PID 2196 wrote to memory of 2172 2196 97250559ff9e569982b39dc250965ef2.exe 29 PID 2196 wrote to memory of 2172 2196 97250559ff9e569982b39dc250965ef2.exe 29 PID 2172 wrote to memory of 2560 2172 97250559ff9e569982b39dc250965ef2.exe 30 PID 2172 wrote to memory of 2560 2172 97250559ff9e569982b39dc250965ef2.exe 30 PID 2172 wrote to memory of 2560 2172 97250559ff9e569982b39dc250965ef2.exe 30 PID 2172 wrote to memory of 2560 2172 97250559ff9e569982b39dc250965ef2.exe 30 PID 2172 wrote to memory of 2628 2172 97250559ff9e569982b39dc250965ef2.exe 32 PID 2172 wrote to memory of 2628 2172 97250559ff9e569982b39dc250965ef2.exe 32 PID 2172 wrote to memory of 2628 2172 97250559ff9e569982b39dc250965ef2.exe 32 PID 2172 wrote to memory of 2628 2172 97250559ff9e569982b39dc250965ef2.exe 32 PID 2628 wrote to memory of 2700 2628 cmd.exe 34 PID 2628 wrote to memory of 2700 2628 cmd.exe 34 PID 2628 wrote to memory of 2700 2628 cmd.exe 34 PID 2628 wrote to memory of 2700 2628 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\97250559ff9e569982b39dc250965ef2.exe"C:\Users\Admin\AppData\Local\Temp\97250559ff9e569982b39dc250965ef2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\97250559ff9e569982b39dc250965ef2.exeC:\Users\Admin\AppData\Local\Temp\97250559ff9e569982b39dc250965ef2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\97250559ff9e569982b39dc250965ef2.exe" /TN 6ek6uOO9da42 /F3⤵
- Creates scheduled task(s)
PID:2560
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN 6ek6uOO9da42 > C:\Users\Admin\AppData\Local\Temp\iq63uNgEy.xml3⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN 6ek6uOO9da424⤵PID:2700
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52facb07c0746ff1e4bbc98bd01bb41c4
SHA1ed5f9ee088f005f76dcb88bbde773805194645a0
SHA256143ab31255748e51f69e8c22d3b2c6c0345ccdbd93b166444d7bf3460547160c
SHA5123b741d653df1b886ec15a43786810273d4aaabcc87c7233edde66c72827bda27d0064893eadd5c9b6a6994ae647990cf762fec83d1447b77de39e498d776f33a
-
Filesize
1003KB
MD556eea71670f3dad4b96106f04f77a0e2
SHA19824845dbc4963ca33eaa287da7f77addf678415
SHA25687f447a11727ac48edb866a13dc54b2b258eda4093a249b0aa09ae475d160811
SHA51271165599c5c323a29a74f0436d4cb838ff86fea9e454281daa2bd2aa89d0749efa0147788553d44f413d10f7aa9e5c1430cd1e67df60d4fe101ea4193e96fe29