Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2024, 19:07

General

  • Target

    b97273d9c2592bf5a6e619fd10a34cbf.exe

  • Size

    133KB

  • MD5

    b97273d9c2592bf5a6e619fd10a34cbf

  • SHA1

    b066e341f8ff65b129228d23ab49ce5f7d779295

  • SHA256

    00b9899634e61a53810fc085643ed5efcdc7599db9320209e8ee03fab34e48bd

  • SHA512

    63e5d9af12e12b96e4a3bf2617c844d319f8973922cb44eab0a1426c9166a26fd1b7fe4fbb1d138c68e0f7534d1ee12332dcacf51db9c818b0e0fe532722e1d6

  • SSDEEP

    3072:QDBPjstu2NB3ehxmpeotXhMTQ3gF7lPdMPIUO1hiA/NM6BQ:mmtvrAxGxROTQO7lPdP14AQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b97273d9c2592bf5a6e619fd10a34cbf.exe
    "C:\Users\Admin\AppData\Local\Temp\b97273d9c2592bf5a6e619fd10a34cbf.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2824
    • C:\Users\Admin\AppData\Local\Temp\b97273d9c2592bf5a6e619fd10a34cbf.exe
      C:\Users\Admin\AppData\Local\Temp\b97273d9c2592bf5a6e619fd10a34cbf.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:4336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\b97273d9c2592bf5a6e619fd10a34cbf.exe

    Filesize

    133KB

    MD5

    d0486d4aa6c34bdba36ba9094446ae80

    SHA1

    099ff2215ce0f48d1d9fc52fc399755469e5d078

    SHA256

    281d04d5a62aba80453fc7810bc06c79775d27e0dbef893e38076c32fc2430a9

    SHA512

    e0229f3130da6aa253b55a202c4a81c077db7146650d5ba6c23ecca88dece5ccb3c59c22fd36e8f5d6bfb839c2976876908640702949db3539c54675b4e96c5b

  • memory/2824-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2824-1-0x00000000001D0000-0x00000000001F1000-memory.dmp

    Filesize

    132KB

  • memory/2824-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2824-13-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4336-16-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/4336-15-0x00000000000D0000-0x00000000000F1000-memory.dmp

    Filesize

    132KB

  • memory/4336-30-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB