Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 09:21

General

  • Target

    be3ea91aeef77123178691460409af80.exe

  • Size

    3.9MB

  • MD5

    be3ea91aeef77123178691460409af80

  • SHA1

    0876c49fc9b1ba5fc66b447a70da9543febf210a

  • SHA256

    d338ce535952dc5c63c78aa7ff0278df82dcd442619931eac88b8f1bc9314861

  • SHA512

    f45af2b275d369b6ab7fad0b1b8b4105635ffeef35187c5f5b5299b377d6059698364e01e9a1f2341e4392c65e422a4a54bdcf088e08b2b25f49e61822d6b593

  • SSDEEP

    98304:m83KPnN07YtKcakcibiqhMbMgOn7n0bcakcibiqhNRza4ZQGWQcakcibiqhMbMgo:m83u07/dlirybMgOnkdlirdH9WQdlirV

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be3ea91aeef77123178691460409af80.exe
    "C:\Users\Admin\AppData\Local\Temp\be3ea91aeef77123178691460409af80.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\be3ea91aeef77123178691460409af80.exe
      C:\Users\Admin\AppData\Local\Temp\be3ea91aeef77123178691460409af80.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\be3ea91aeef77123178691460409af80.exe" /TN guALCTR926f5 /F
        3⤵
        • Creates scheduled task(s)
        PID:2532
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN guALCTR926f5 > C:\Users\Admin\AppData\Local\Temp\OUQc2JY.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2412
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN guALCTR926f5
          4⤵
            PID:2524

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OUQc2JY.xml

      Filesize

      1KB

      MD5

      3f60c87afa9f687fe90bd6146df6c188

      SHA1

      d462dd2abb4b4929da7e93481278d52e73703d87

      SHA256

      7f8015a7eb6add98c6f63b83307d40cd5e41e59f6190251f4c7866b6180409f4

      SHA512

      52198e906305633af986f46c7b1fdc81c8261cc1038eabc5bd348ad7f8f1e0770e2db29c220f0bab4e8da0ef8da61b97c1e25a71c2db4824043a10a54d330f34

    • \Users\Admin\AppData\Local\Temp\be3ea91aeef77123178691460409af80.exe

      Filesize

      3.9MB

      MD5

      29dd342002a13e17eab720a7a9cb4c5c

      SHA1

      24f33f38cef4b31cb0efe9fe73a265895d1eccbd

      SHA256

      0c1a1644445a125772e0f02c383a1de52c93cbe06335615119882895f7a98620

      SHA512

      dd8bb9a986351ec3ffbddca016c7ebc4ee772e6647583fee32658c82353363dd01248892ab315605346b035ac751e9b38c496c9f9d75bd4ced7a033c7cae1bb8

    • memory/1960-0-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/1960-4-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/1960-6-0x00000000001B0000-0x000000000022E000-memory.dmp

      Filesize

      504KB

    • memory/1960-16-0x0000000023810000-0x0000000023A6C000-memory.dmp

      Filesize

      2.4MB

    • memory/1960-15-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/3060-18-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/3060-20-0x0000000000240000-0x00000000002BE000-memory.dmp

      Filesize

      504KB

    • memory/3060-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/3060-27-0x0000000000320000-0x000000000038B000-memory.dmp

      Filesize

      428KB

    • memory/3060-54-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB