Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 02:37
Behavioral task
behavioral1
Sample
9a8a37f89bead8fbd092114803b1f42c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9a8a37f89bead8fbd092114803b1f42c.exe
Resource
win10v2004-20231215-en
General
-
Target
9a8a37f89bead8fbd092114803b1f42c.exe
-
Size
1003KB
-
MD5
9a8a37f89bead8fbd092114803b1f42c
-
SHA1
9f0908f4539275c501b553dcfee4a88d2c4bee9c
-
SHA256
9045386ce21635fc664d22561bbde54d33a3e4fc43cff2e23d50361ddd339857
-
SHA512
4665ca2a9eb492e14304ca2900e8ff3a514da2ea2d95d61a7737c93d13afbf346abaa33353c20f5695e73fd4051982cdbdd4780bba44cb6ad3fe03ef3cff6d2a
-
SSDEEP
24576:NOIWAUj7AXwSOnvviTbyfEcjukL2CDYibq6/yqLNaF:NOlAYAgTv4yMcakLz0ibq6yqh
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2376 9a8a37f89bead8fbd092114803b1f42c.exe -
Executes dropped EXE 1 IoCs
pid Process 2376 9a8a37f89bead8fbd092114803b1f42c.exe -
Loads dropped DLL 1 IoCs
pid Process 2316 9a8a37f89bead8fbd092114803b1f42c.exe -
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/files/0x0009000000014abe-16.dat upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 2 pastebin.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2568 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 9a8a37f89bead8fbd092114803b1f42c.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 9a8a37f89bead8fbd092114803b1f42c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 9a8a37f89bead8fbd092114803b1f42c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 9a8a37f89bead8fbd092114803b1f42c.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2316 9a8a37f89bead8fbd092114803b1f42c.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2316 9a8a37f89bead8fbd092114803b1f42c.exe 2376 9a8a37f89bead8fbd092114803b1f42c.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2376 2316 9a8a37f89bead8fbd092114803b1f42c.exe 29 PID 2316 wrote to memory of 2376 2316 9a8a37f89bead8fbd092114803b1f42c.exe 29 PID 2316 wrote to memory of 2376 2316 9a8a37f89bead8fbd092114803b1f42c.exe 29 PID 2316 wrote to memory of 2376 2316 9a8a37f89bead8fbd092114803b1f42c.exe 29 PID 2376 wrote to memory of 2568 2376 9a8a37f89bead8fbd092114803b1f42c.exe 30 PID 2376 wrote to memory of 2568 2376 9a8a37f89bead8fbd092114803b1f42c.exe 30 PID 2376 wrote to memory of 2568 2376 9a8a37f89bead8fbd092114803b1f42c.exe 30 PID 2376 wrote to memory of 2568 2376 9a8a37f89bead8fbd092114803b1f42c.exe 30 PID 2376 wrote to memory of 2644 2376 9a8a37f89bead8fbd092114803b1f42c.exe 32 PID 2376 wrote to memory of 2644 2376 9a8a37f89bead8fbd092114803b1f42c.exe 32 PID 2376 wrote to memory of 2644 2376 9a8a37f89bead8fbd092114803b1f42c.exe 32 PID 2376 wrote to memory of 2644 2376 9a8a37f89bead8fbd092114803b1f42c.exe 32 PID 2644 wrote to memory of 2572 2644 cmd.exe 34 PID 2644 wrote to memory of 2572 2644 cmd.exe 34 PID 2644 wrote to memory of 2572 2644 cmd.exe 34 PID 2644 wrote to memory of 2572 2644 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a8a37f89bead8fbd092114803b1f42c.exe"C:\Users\Admin\AppData\Local\Temp\9a8a37f89bead8fbd092114803b1f42c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\9a8a37f89bead8fbd092114803b1f42c.exeC:\Users\Admin\AppData\Local\Temp\9a8a37f89bead8fbd092114803b1f42c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\9a8a37f89bead8fbd092114803b1f42c.exe" /TN 6ek6uOO9da42 /F3⤵
- Creates scheduled task(s)
PID:2568
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN 6ek6uOO9da42 > C:\Users\Admin\AppData\Local\Temp\m0SkGWD.xml3⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN 6ek6uOO9da424⤵PID:2572
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1003KB
MD506d02eebc85acf66e32219dc7c69a5e8
SHA1fb5a56d2c5a568ba70df0ee76bca89aff8ce0357
SHA2563773c8e0a419c161820f5e1981e4f439e5be0ad36d9b43d5c861838da2ce73ea
SHA512fc2b63d94a6309bab9b57a2d98c7684ffc9c562d1ea7be3194f9ca2aab28313fcb23dd76ba0245d43ff4198d2815a75600ede62f57b3e508b237ba027ca40157
-
Filesize
1KB
MD5b83e5edb179afab31699cce8dbaae44c
SHA1fca621d3a31af11825a8ae11ab76378531fb7b4f
SHA256b2e4c54ca7fc272de648361e55df2ccb196dc661a243ca351f825070bd40abde
SHA5128539a46b34e7138787e4297af97d67d27f0784863affc7bf54766fdc3ab7730f6f9d06d17ee11a8da23318f9a328704323c9f673de1bd5e83838dc6a36e451b0