Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2024, 18:29

General

  • Target

    b815704e21bd4b6f404e18eb2d1f2e2a.exe

  • Size

    6.0MB

  • MD5

    b815704e21bd4b6f404e18eb2d1f2e2a

  • SHA1

    eb9e86eed8c023a86adaff7b1fad8227a67d7cb5

  • SHA256

    e203d0b6c493e342a4fbac8eb22f820747d2787bbb22d24fc5e68e2007bdef47

  • SHA512

    99210b8da8bdabbf13c807346da2aa460edec152d6c9788950a4a61488d299184cbf508c9c9d5cf949401bf93940b2e9be295097a91e1c45d576c1410f542a18

  • SSDEEP

    98304:Mvs6Qiu51kcakOWZDtQXWry7mBZbkcaksDjGDHRQlywbcakOWZDtQXWry7mBZbk/:MvskurkdiaWry7mbYdfPlbdiaWry7mbW

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe
    "C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe
      C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe" /TN MJu5Ub8Eff50 /F
        3⤵
        • Creates scheduled task(s)
        PID:2544
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN MJu5Ub8Eff50 > C:\Users\Admin\AppData\Local\Temp\XrWlqa.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN MJu5Ub8Eff50
          4⤵
            PID:2528

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\XrWlqa.xml

      Filesize

      1KB

      MD5

      b4874a5784e83e7df77920ca1253b31b

      SHA1

      85afbf486cc013f21bf5fccd036a0cd10a82ee86

      SHA256

      f6ce8664c6db55ba8c554e587497890ed1c0e96f0b4376d5c1c3a33695403d94

      SHA512

      960a2534f731b657774679ac7d126135f82d0666a9585e44c73dbacf2c86a1a85914541272cdd68f684009b6bcfff35778b4efbc7be03a716b378324e353407b

    • C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe

      Filesize

      704KB

      MD5

      32893ef051057ecaabbe8d026050799f

      SHA1

      4f712b9f312273a8b065de9ba84fa8146171066f

      SHA256

      4d0307afd4840797aaf8bb6339e10d5521328bb1449757b0c4cc76bf163601d3

      SHA512

      b170f8dee7bc7b9aa80dfe9008a0902cfc8aa5af3bcfe1e6e05021752ad005a5a3b7be2414dea426ba33046160c74b4df6ffbdd18c15f06364405747af15949a

    • \Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe

      Filesize

      896KB

      MD5

      89397d761e3c0aa5e4086f8686cfc813

      SHA1

      0729cd8a6b08d35c98fb6dfd423e138196dd4c20

      SHA256

      0baafeac5310f90b7734acabad44337b829cf5193e6e3f4c2068917d077d8cc1

      SHA512

      18cbce84008d63683d3f72dd6964de5f4327ddf58618b61f075a73f58a77f354b1aa913b4c58c162cd7d2ad4c4141481e05bd98b942e6fcd5be4e171517e428d

    • memory/1500-15-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/1500-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/1500-16-0x0000000023C70000-0x0000000023ECC000-memory.dmp

      Filesize

      2.4MB

    • memory/1500-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/1500-2-0x00000000001A0000-0x000000000021E000-memory.dmp

      Filesize

      504KB

    • memory/1500-54-0x0000000023C70000-0x0000000023ECC000-memory.dmp

      Filesize

      2.4MB

    • memory/3048-19-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/3048-21-0x0000000000380000-0x00000000003FE000-memory.dmp

      Filesize

      504KB

    • memory/3048-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/3048-31-0x0000000000470000-0x00000000004DB000-memory.dmp

      Filesize

      428KB

    • memory/3048-55-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB