Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 21:09
Behavioral task
behavioral1
Sample
b9aa6bfd6554e10fe7867727654801c7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b9aa6bfd6554e10fe7867727654801c7.exe
Resource
win10v2004-20231215-en
General
-
Target
b9aa6bfd6554e10fe7867727654801c7.exe
-
Size
821KB
-
MD5
b9aa6bfd6554e10fe7867727654801c7
-
SHA1
bee8f7aee4bb5000051d1b6f325e65111f527ff5
-
SHA256
61af64829c5b451da16b284b5f279e98172997f51c1f66438b9f1d752e9057dd
-
SHA512
69de60cc12288e8306eec3c65319d796f2a6071153b414aeb6385dc1587f11a998a8277602ea9b46ca160a5e21d04fb27dad7221987208cd10a737f04520ad17
-
SSDEEP
24576:bu5ZyQCunbTTctmOHsyhD7wCgG3cjukL2CDYO:bu50QVbTTAPsUnwHG3cakLz0O
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2400 b9aa6bfd6554e10fe7867727654801c7.exe -
Executes dropped EXE 1 IoCs
pid Process 2400 b9aa6bfd6554e10fe7867727654801c7.exe -
Loads dropped DLL 1 IoCs
pid Process 1044 b9aa6bfd6554e10fe7867727654801c7.exe -
resource yara_rule behavioral1/memory/1044-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/memory/2400-17-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/files/0x0009000000015d1a-15.dat upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 2 pastebin.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2624 schtasks.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 b9aa6bfd6554e10fe7867727654801c7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 b9aa6bfd6554e10fe7867727654801c7.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 b9aa6bfd6554e10fe7867727654801c7.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 b9aa6bfd6554e10fe7867727654801c7.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1044 b9aa6bfd6554e10fe7867727654801c7.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1044 b9aa6bfd6554e10fe7867727654801c7.exe 2400 b9aa6bfd6554e10fe7867727654801c7.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2400 1044 b9aa6bfd6554e10fe7867727654801c7.exe 29 PID 1044 wrote to memory of 2400 1044 b9aa6bfd6554e10fe7867727654801c7.exe 29 PID 1044 wrote to memory of 2400 1044 b9aa6bfd6554e10fe7867727654801c7.exe 29 PID 1044 wrote to memory of 2400 1044 b9aa6bfd6554e10fe7867727654801c7.exe 29 PID 2400 wrote to memory of 2624 2400 b9aa6bfd6554e10fe7867727654801c7.exe 30 PID 2400 wrote to memory of 2624 2400 b9aa6bfd6554e10fe7867727654801c7.exe 30 PID 2400 wrote to memory of 2624 2400 b9aa6bfd6554e10fe7867727654801c7.exe 30 PID 2400 wrote to memory of 2624 2400 b9aa6bfd6554e10fe7867727654801c7.exe 30 PID 2400 wrote to memory of 2680 2400 b9aa6bfd6554e10fe7867727654801c7.exe 32 PID 2400 wrote to memory of 2680 2400 b9aa6bfd6554e10fe7867727654801c7.exe 32 PID 2400 wrote to memory of 2680 2400 b9aa6bfd6554e10fe7867727654801c7.exe 32 PID 2400 wrote to memory of 2680 2400 b9aa6bfd6554e10fe7867727654801c7.exe 32 PID 2680 wrote to memory of 2712 2680 cmd.exe 34 PID 2680 wrote to memory of 2712 2680 cmd.exe 34 PID 2680 wrote to memory of 2712 2680 cmd.exe 34 PID 2680 wrote to memory of 2712 2680 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9aa6bfd6554e10fe7867727654801c7.exe"C:\Users\Admin\AppData\Local\Temp\b9aa6bfd6554e10fe7867727654801c7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\b9aa6bfd6554e10fe7867727654801c7.exeC:\Users\Admin\AppData\Local\Temp\b9aa6bfd6554e10fe7867727654801c7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b9aa6bfd6554e10fe7867727654801c7.exe" /TN 6ek6uOO9da42 /F3⤵
- Creates scheduled task(s)
PID:2624
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN 6ek6uOO9da42 > C:\Users\Admin\AppData\Local\Temp\DTaRcc.xml3⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN 6ek6uOO9da424⤵PID:2712
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD540a74493c621f976a030ec4eac3cb0f5
SHA1527b00c2698f6920be545bd544f99157f92297a9
SHA25687e9ad1811357a7bd32c84a517427d935326c381dce2aee0406b846210e98753
SHA512aa327c14c04155a49b943721304cbfd7fb577eaeb56f9e5f2130a29a9bab1af35dda2be5b58386a3eef959ccf5dc2bca37453f83ee99be6493cfca962c42471b
-
Filesize
821KB
MD5411709391ea262bb734ff27f76a2b735
SHA1d25869ab86ad21ba98ce1b90670248b079b602db
SHA256fcef6aa5866f8e25564e70ec55bf8bb83c9cdbeb32de48fbb5cc016090b41f5e
SHA512f3d8f8448e130de29f6c1f72c9b717ff113eddce4bbec342340f097d467e8e9ba94d10370e69c7edede0148cfc87f37138bbea68c4b196b06cde93302bc618fa