Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2024, 13:58

General

  • Target

    bb704cac1d6f266a562ef3d48086dea5.exe

  • Size

    133KB

  • MD5

    bb704cac1d6f266a562ef3d48086dea5

  • SHA1

    494153bb6da2b2a9266f17be4ac166e54690bd19

  • SHA256

    cc7bf88339e9d838d5bfeae9b5411d8c11ebe78ccd59c2076ab5bc251530c8d6

  • SHA512

    7a956a090608a573af95c57305dd55d1a4d703b5acee915fd63b68a01f1c2d51d9cac43496675c590f7daf48515de52a9dee9b767976876de6dcc491e8793f04

  • SSDEEP

    3072:C4WLAYEjg+tzEhzJW05mWYWgWcupnWqv5WPB/ab0OqQ:FYtbzJWFWYWrcupWiWZ/U0HQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb704cac1d6f266a562ef3d48086dea5.exe
    "C:\Users\Admin\AppData\Local\Temp\bb704cac1d6f266a562ef3d48086dea5.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Users\Admin\AppData\Local\Temp\bb704cac1d6f266a562ef3d48086dea5.exe
      C:\Users\Admin\AppData\Local\Temp\bb704cac1d6f266a562ef3d48086dea5.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\bb704cac1d6f266a562ef3d48086dea5.exe

    Filesize

    133KB

    MD5

    9452180cd459265ed7b960ccb8b157d5

    SHA1

    fa3a5ac13126cb0c2b9357fd6c1fb0e27a8588de

    SHA256

    8fe595a5ab690c6afdf04e289e85914c4412fd04886026b32e2dd4310879447c

    SHA512

    a4e37179e173752eb4dfe55667b45b876b1aaf42f39b04d07113171532bec661c5d801a9a7ec496841d8a2e1e681d01ea967ddf0e1acdcbd8332e95c809e0cbf

  • memory/2352-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2352-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2352-1-0x00000000000E0000-0x0000000000101000-memory.dmp

    Filesize

    132KB

  • memory/2352-18-0x0000000000350000-0x00000000003D6000-memory.dmp

    Filesize

    536KB

  • memory/2352-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2352-43-0x0000000000350000-0x00000000003D6000-memory.dmp

    Filesize

    536KB

  • memory/2572-16-0x00000000002F0000-0x0000000000311000-memory.dmp

    Filesize

    132KB

  • memory/2572-20-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2572-44-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB