Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07/03/2024, 21:09

General

  • Target

    b9aa6bfd6554e10fe7867727654801c7.exe

  • Size

    821KB

  • MD5

    b9aa6bfd6554e10fe7867727654801c7

  • SHA1

    bee8f7aee4bb5000051d1b6f325e65111f527ff5

  • SHA256

    61af64829c5b451da16b284b5f279e98172997f51c1f66438b9f1d752e9057dd

  • SHA512

    69de60cc12288e8306eec3c65319d796f2a6071153b414aeb6385dc1587f11a998a8277602ea9b46ca160a5e21d04fb27dad7221987208cd10a737f04520ad17

  • SSDEEP

    24576:bu5ZyQCunbTTctmOHsyhD7wCgG3cjukL2CDYO:bu50QVbTTAPsUnwHG3cakLz0O

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9aa6bfd6554e10fe7867727654801c7.exe
    "C:\Users\Admin\AppData\Local\Temp\b9aa6bfd6554e10fe7867727654801c7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Users\Admin\AppData\Local\Temp\b9aa6bfd6554e10fe7867727654801c7.exe
      C:\Users\Admin\AppData\Local\Temp\b9aa6bfd6554e10fe7867727654801c7.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b9aa6bfd6554e10fe7867727654801c7.exe" /TN 6ek6uOO9da42 /F
        3⤵
        • Creates scheduled task(s)
        PID:2624
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN 6ek6uOO9da42 > C:\Users\Admin\AppData\Local\Temp\DTaRcc.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2680
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN 6ek6uOO9da42
          4⤵
            PID:2712

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\DTaRcc.xml

      Filesize

      1KB

      MD5

      40a74493c621f976a030ec4eac3cb0f5

      SHA1

      527b00c2698f6920be545bd544f99157f92297a9

      SHA256

      87e9ad1811357a7bd32c84a517427d935326c381dce2aee0406b846210e98753

      SHA512

      aa327c14c04155a49b943721304cbfd7fb577eaeb56f9e5f2130a29a9bab1af35dda2be5b58386a3eef959ccf5dc2bca37453f83ee99be6493cfca962c42471b

    • C:\Users\Admin\AppData\Local\Temp\b9aa6bfd6554e10fe7867727654801c7.exe

      Filesize

      821KB

      MD5

      411709391ea262bb734ff27f76a2b735

      SHA1

      d25869ab86ad21ba98ce1b90670248b079b602db

      SHA256

      fcef6aa5866f8e25564e70ec55bf8bb83c9cdbeb32de48fbb5cc016090b41f5e

      SHA512

      f3d8f8448e130de29f6c1f72c9b717ff113eddce4bbec342340f097d467e8e9ba94d10370e69c7edede0148cfc87f37138bbea68c4b196b06cde93302bc618fa

    • memory/1044-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/1044-2-0x0000000000240000-0x00000000002BE000-memory.dmp

      Filesize

      504KB

    • memory/1044-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/1044-16-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2400-17-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2400-20-0x0000000022D90000-0x0000000022E0E000-memory.dmp

      Filesize

      504KB

    • memory/2400-25-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2400-29-0x0000000000470000-0x00000000004DB000-memory.dmp

      Filesize

      428KB

    • memory/2400-40-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB