Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 00:46
Behavioral task
behavioral1
Sample
c207539996f18f579f3e0c09659b36d9.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c207539996f18f579f3e0c09659b36d9.exe
Resource
win10v2004-20240226-en
General
-
Target
c207539996f18f579f3e0c09659b36d9.exe
-
Size
2.0MB
-
MD5
c207539996f18f579f3e0c09659b36d9
-
SHA1
60a0dd5c49b60a3a72913f7fd6ff83e1176dad3d
-
SHA256
7290afd24db468e18cd50e88e1ef9142e4090ce40e536f2167be1ce5c79a3555
-
SHA512
3f968728193cc7dfb2fde2c8627b974c50d4b54d4e847f6234c4f8bda79134d4b193a67872db073780fb407651cdc9539c803ed2a758b7f002589e02e6551269
-
SSDEEP
49152:j+dPF54ZZYCzWcN+9zWFULG+wk7jF3bQVKqcN+9zWFULG+:j+dPF5AzfA9zyULG+wk7jF3bQVGA9zya
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2556 c207539996f18f579f3e0c09659b36d9.exe -
Executes dropped EXE 1 IoCs
pid Process 2556 c207539996f18f579f3e0c09659b36d9.exe -
Loads dropped DLL 1 IoCs
pid Process 1976 c207539996f18f579f3e0c09659b36d9.exe -
resource yara_rule behavioral1/memory/1976-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/files/0x000d000000012253-11.dat upx behavioral1/memory/1976-16-0x00000000232C0000-0x000000002351C000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 2 pastebin.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2420 schtasks.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 c207539996f18f579f3e0c09659b36d9.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 c207539996f18f579f3e0c09659b36d9.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 c207539996f18f579f3e0c09659b36d9.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 c207539996f18f579f3e0c09659b36d9.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1976 c207539996f18f579f3e0c09659b36d9.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1976 c207539996f18f579f3e0c09659b36d9.exe 2556 c207539996f18f579f3e0c09659b36d9.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2556 1976 c207539996f18f579f3e0c09659b36d9.exe 29 PID 1976 wrote to memory of 2556 1976 c207539996f18f579f3e0c09659b36d9.exe 29 PID 1976 wrote to memory of 2556 1976 c207539996f18f579f3e0c09659b36d9.exe 29 PID 1976 wrote to memory of 2556 1976 c207539996f18f579f3e0c09659b36d9.exe 29 PID 2556 wrote to memory of 2420 2556 c207539996f18f579f3e0c09659b36d9.exe 30 PID 2556 wrote to memory of 2420 2556 c207539996f18f579f3e0c09659b36d9.exe 30 PID 2556 wrote to memory of 2420 2556 c207539996f18f579f3e0c09659b36d9.exe 30 PID 2556 wrote to memory of 2420 2556 c207539996f18f579f3e0c09659b36d9.exe 30 PID 2556 wrote to memory of 2628 2556 c207539996f18f579f3e0c09659b36d9.exe 32 PID 2556 wrote to memory of 2628 2556 c207539996f18f579f3e0c09659b36d9.exe 32 PID 2556 wrote to memory of 2628 2556 c207539996f18f579f3e0c09659b36d9.exe 32 PID 2556 wrote to memory of 2628 2556 c207539996f18f579f3e0c09659b36d9.exe 32 PID 2628 wrote to memory of 2724 2628 cmd.exe 34 PID 2628 wrote to memory of 2724 2628 cmd.exe 34 PID 2628 wrote to memory of 2724 2628 cmd.exe 34 PID 2628 wrote to memory of 2724 2628 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\c207539996f18f579f3e0c09659b36d9.exe"C:\Users\Admin\AppData\Local\Temp\c207539996f18f579f3e0c09659b36d9.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\c207539996f18f579f3e0c09659b36d9.exeC:\Users\Admin\AppData\Local\Temp\c207539996f18f579f3e0c09659b36d9.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c207539996f18f579f3e0c09659b36d9.exe" /TN w6CK1HQd991c /F3⤵
- Creates scheduled task(s)
PID:2420
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN w6CK1HQd991c > C:\Users\Admin\AppData\Local\Temp\EWCX5P9pF.xml3⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN w6CK1HQd991c4⤵PID:2724
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a8e40c8be27115ed372072b4609984ff
SHA15c7fc2af567cc564b6239298763e247a530d5a32
SHA25632a75abbcb941e729468b815eadad00d4b51003cd49256f6aca929262c19dac3
SHA512e607fa60e003f727789bd6ea3a317f9187ef453782b52d6d51044eac245941ada8b3a08b9b5b237aeff4a0182b7a9902254165473838ff55254344a71f786eea
-
Filesize
2.0MB
MD5112b0c2e48130292f9be43f772fc8cc9
SHA17c0f31584a96cdc379b9ce34e8adb4f0af28eb0a
SHA256dfa7d2389b2f01244ae0e2a95481cf678cbb9aed6f0954d5e3b2e86d09d190e3
SHA5128d806ada9afbab94605b3c904893ed31a61d0e08518eb38ea7145be1ee2c9e30d7c3857ff62ac5f0d40cfb99d63702c1edbd06e73ca66e46f4b990050a1d41b0