Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 18:29
Behavioral task
behavioral1
Sample
b815704e21bd4b6f404e18eb2d1f2e2a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b815704e21bd4b6f404e18eb2d1f2e2a.exe
Resource
win10v2004-20240226-en
General
-
Target
b815704e21bd4b6f404e18eb2d1f2e2a.exe
-
Size
6.0MB
-
MD5
b815704e21bd4b6f404e18eb2d1f2e2a
-
SHA1
eb9e86eed8c023a86adaff7b1fad8227a67d7cb5
-
SHA256
e203d0b6c493e342a4fbac8eb22f820747d2787bbb22d24fc5e68e2007bdef47
-
SHA512
99210b8da8bdabbf13c807346da2aa460edec152d6c9788950a4a61488d299184cbf508c9c9d5cf949401bf93940b2e9be295097a91e1c45d576c1410f542a18
-
SSDEEP
98304:Mvs6Qiu51kcakOWZDtQXWry7mBZbkcaksDjGDHRQlywbcakOWZDtQXWry7mBZbk/:MvskurkdiaWry7mbYdfPlbdiaWry7mbW
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3048 b815704e21bd4b6f404e18eb2d1f2e2a.exe -
Executes dropped EXE 1 IoCs
pid Process 3048 b815704e21bd4b6f404e18eb2d1f2e2a.exe -
Loads dropped DLL 1 IoCs
pid Process 1500 b815704e21bd4b6f404e18eb2d1f2e2a.exe -
resource yara_rule behavioral1/memory/1500-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/files/0x000c000000012240-11.dat upx behavioral1/files/0x000c000000012240-17.dat upx behavioral1/memory/1500-16-0x0000000023C70000-0x0000000023ECC000-memory.dmp upx behavioral1/memory/3048-19-0x0000000000400000-0x000000000065C000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 2 pastebin.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2544 schtasks.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 b815704e21bd4b6f404e18eb2d1f2e2a.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 b815704e21bd4b6f404e18eb2d1f2e2a.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 b815704e21bd4b6f404e18eb2d1f2e2a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 b815704e21bd4b6f404e18eb2d1f2e2a.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1500 b815704e21bd4b6f404e18eb2d1f2e2a.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1500 b815704e21bd4b6f404e18eb2d1f2e2a.exe 3048 b815704e21bd4b6f404e18eb2d1f2e2a.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1500 wrote to memory of 3048 1500 b815704e21bd4b6f404e18eb2d1f2e2a.exe 29 PID 1500 wrote to memory of 3048 1500 b815704e21bd4b6f404e18eb2d1f2e2a.exe 29 PID 1500 wrote to memory of 3048 1500 b815704e21bd4b6f404e18eb2d1f2e2a.exe 29 PID 1500 wrote to memory of 3048 1500 b815704e21bd4b6f404e18eb2d1f2e2a.exe 29 PID 3048 wrote to memory of 2544 3048 b815704e21bd4b6f404e18eb2d1f2e2a.exe 30 PID 3048 wrote to memory of 2544 3048 b815704e21bd4b6f404e18eb2d1f2e2a.exe 30 PID 3048 wrote to memory of 2544 3048 b815704e21bd4b6f404e18eb2d1f2e2a.exe 30 PID 3048 wrote to memory of 2544 3048 b815704e21bd4b6f404e18eb2d1f2e2a.exe 30 PID 3048 wrote to memory of 2576 3048 b815704e21bd4b6f404e18eb2d1f2e2a.exe 32 PID 3048 wrote to memory of 2576 3048 b815704e21bd4b6f404e18eb2d1f2e2a.exe 32 PID 3048 wrote to memory of 2576 3048 b815704e21bd4b6f404e18eb2d1f2e2a.exe 32 PID 3048 wrote to memory of 2576 3048 b815704e21bd4b6f404e18eb2d1f2e2a.exe 32 PID 2576 wrote to memory of 2528 2576 cmd.exe 34 PID 2576 wrote to memory of 2528 2576 cmd.exe 34 PID 2576 wrote to memory of 2528 2576 cmd.exe 34 PID 2576 wrote to memory of 2528 2576 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe"C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exeC:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe" /TN MJu5Ub8Eff50 /F3⤵
- Creates scheduled task(s)
PID:2544
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN MJu5Ub8Eff50 > C:\Users\Admin\AppData\Local\Temp\XrWlqa.xml3⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN MJu5Ub8Eff504⤵PID:2528
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b4874a5784e83e7df77920ca1253b31b
SHA185afbf486cc013f21bf5fccd036a0cd10a82ee86
SHA256f6ce8664c6db55ba8c554e587497890ed1c0e96f0b4376d5c1c3a33695403d94
SHA512960a2534f731b657774679ac7d126135f82d0666a9585e44c73dbacf2c86a1a85914541272cdd68f684009b6bcfff35778b4efbc7be03a716b378324e353407b
-
Filesize
704KB
MD532893ef051057ecaabbe8d026050799f
SHA14f712b9f312273a8b065de9ba84fa8146171066f
SHA2564d0307afd4840797aaf8bb6339e10d5521328bb1449757b0c4cc76bf163601d3
SHA512b170f8dee7bc7b9aa80dfe9008a0902cfc8aa5af3bcfe1e6e05021752ad005a5a3b7be2414dea426ba33046160c74b4df6ffbdd18c15f06364405747af15949a
-
Filesize
896KB
MD589397d761e3c0aa5e4086f8686cfc813
SHA10729cd8a6b08d35c98fb6dfd423e138196dd4c20
SHA2560baafeac5310f90b7734acabad44337b829cf5193e6e3f4c2068917d077d8cc1
SHA51218cbce84008d63683d3f72dd6964de5f4327ddf58618b61f075a73f58a77f354b1aa913b4c58c162cd7d2ad4c4141481e05bd98b942e6fcd5be4e171517e428d