Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 01:07 UTC
Behavioral task
behavioral1
Sample
bd42f0b2aee960d31fe15f51a2643a88.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bd42f0b2aee960d31fe15f51a2643a88.exe
Resource
win10v2004-20240226-en
General
-
Target
bd42f0b2aee960d31fe15f51a2643a88.exe
-
Size
5.1MB
-
MD5
bd42f0b2aee960d31fe15f51a2643a88
-
SHA1
3729756c54031689d24c41c1497e05846566b252
-
SHA256
8ce2739993c6e4e6630640b747d4ed819da9708d8ca2d3d232945e1482764304
-
SHA512
5252a46e1c780016b9b464e5bef727b9f6f9638da79cc4a84686010fc6406bdf85b1de0bc6d62b3bf34308b49be1e0b697098a81a4e477e9a13f7f95f9d33285
-
SSDEEP
49152:bhVHQT/Yd5WSHN8lxnTVy3yXBLHdez+7rxdbm2pQW9Cay3zgkUNCgdutXXRg6FZz:FVqkNKnzBLHTxeR3znSchG+3
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2528 bd42f0b2aee960d31fe15f51a2643a88.exe -
Executes dropped EXE 1 IoCs
pid Process 2528 bd42f0b2aee960d31fe15f51a2643a88.exe -
Loads dropped DLL 1 IoCs
pid Process 1548 bd42f0b2aee960d31fe15f51a2643a88.exe -
resource yara_rule behavioral1/memory/1548-1-0x0000000000400000-0x0000000000D9E000-memory.dmp upx behavioral1/files/0x000d000000014466-11.dat upx behavioral1/files/0x000d000000014466-15.dat upx behavioral1/memory/2528-17-0x0000000000400000-0x0000000000D9E000-memory.dmp upx -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 bd42f0b2aee960d31fe15f51a2643a88.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 bd42f0b2aee960d31fe15f51a2643a88.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 bd42f0b2aee960d31fe15f51a2643a88.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 bd42f0b2aee960d31fe15f51a2643a88.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1548 bd42f0b2aee960d31fe15f51a2643a88.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1548 bd42f0b2aee960d31fe15f51a2643a88.exe 2528 bd42f0b2aee960d31fe15f51a2643a88.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1548 wrote to memory of 2528 1548 bd42f0b2aee960d31fe15f51a2643a88.exe 28 PID 1548 wrote to memory of 2528 1548 bd42f0b2aee960d31fe15f51a2643a88.exe 28 PID 1548 wrote to memory of 2528 1548 bd42f0b2aee960d31fe15f51a2643a88.exe 28 PID 1548 wrote to memory of 2528 1548 bd42f0b2aee960d31fe15f51a2643a88.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd42f0b2aee960d31fe15f51a2643a88.exe"C:\Users\Admin\AppData\Local\Temp\bd42f0b2aee960d31fe15f51a2643a88.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\bd42f0b2aee960d31fe15f51a2643a88.exeC:\Users\Admin\AppData\Local\Temp\bd42f0b2aee960d31fe15f51a2643a88.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
PID:2528
-
Network
-
Remote address:8.8.8.8:53Requestcutit.orgIN AResponsecutit.orgIN A64.91.240.248
-
Remote address:8.8.8.8:53Requestww7.cutit.orgIN AResponseww7.cutit.orgIN CNAME78626.bodis.com78626.bodis.comIN A199.59.243.225
-
Remote address:199.59.243.225:80RequestGET /oxgBR?usid=25&utid=5859220521 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Connection: Keep-Alive
Cache-Control: no-cache
Host: ww7.cutit.org
ResponseHTTP/1.1 200 OK
content-type: text/html; charset=utf-8
content-length: 1126
x-request-id: 7ac12148-0092-4d4c-b1dc-4bb2af0455ee
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_JvUmH57P8FmJrNSG4gOkDqlEhjqvfer3x67HlXV1Y/U76bxFp8D/NEJLP0LsJx/zCFld9iRTsR2X/EY8cvJUFQ==
set-cookie: parking_session=7ac12148-0092-4d4c-b1dc-4bb2af0455ee; expires=Sun, 10 Mar 2024 01:22:16 GMT; path=/
-
1.3kB 3.4kB 12 9
-
199.59.243.225:80http://ww7.cutit.org/oxgBR?usid=25&utid=5859220521httpbd42f0b2aee960d31fe15f51a2643a88.exe813 B 2.6kB 13 6
HTTP Request
GET http://ww7.cutit.org/oxgBR?usid=25&utid=5859220521HTTP Response
200
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD538ecfc9f5fa511da00ae2738159542c7
SHA132a7dfba0e8c88fd3f8b261273ff92033af05122
SHA256368a603352291121fcbf414a6baf5c0cb067b1c4889b0828a441ea6ffec2f6f1
SHA512edd677e3e69b0dfff05d40d4e73aef0c7156e9edd100d7b3bfa9299cd50375c9702670641773d16ef6acbec542c4bd5e9886bd753946b630020e33b93ab2245e
-
Filesize
1.9MB
MD5e11149a06bf093fe006690131416d7c5
SHA16d3a707745ea505d10bf52eae903d4a38fda8054
SHA256169b619b7f53165d79fcf8037abe27658a380ece453b07ae06b6fc8a310df767
SHA5121f2da2b12202bb63879454f2e60f3881fb06e7daede5f3261d8f3feefb8d8634d625709b9f67b1e2b51a0d3e5868161acb519f63de57207b691bd83c3e5f9a8f