Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    12/03/2024, 00:46

General

  • Target

    c207539996f18f579f3e0c09659b36d9.exe

  • Size

    2.0MB

  • MD5

    c207539996f18f579f3e0c09659b36d9

  • SHA1

    60a0dd5c49b60a3a72913f7fd6ff83e1176dad3d

  • SHA256

    7290afd24db468e18cd50e88e1ef9142e4090ce40e536f2167be1ce5c79a3555

  • SHA512

    3f968728193cc7dfb2fde2c8627b974c50d4b54d4e847f6234c4f8bda79134d4b193a67872db073780fb407651cdc9539c803ed2a758b7f002589e02e6551269

  • SSDEEP

    49152:j+dPF54ZZYCzWcN+9zWFULG+wk7jF3bQVKqcN+9zWFULG+:j+dPF5AzfA9zyULG+wk7jF3bQVGA9zya

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c207539996f18f579f3e0c09659b36d9.exe
    "C:\Users\Admin\AppData\Local\Temp\c207539996f18f579f3e0c09659b36d9.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\AppData\Local\Temp\c207539996f18f579f3e0c09659b36d9.exe
      C:\Users\Admin\AppData\Local\Temp\c207539996f18f579f3e0c09659b36d9.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2556
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c207539996f18f579f3e0c09659b36d9.exe" /TN w6CK1HQd991c /F
        3⤵
        • Creates scheduled task(s)
        PID:2420
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN w6CK1HQd991c > C:\Users\Admin\AppData\Local\Temp\EWCX5P9pF.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2628
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN w6CK1HQd991c
          4⤵
            PID:2724

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\EWCX5P9pF.xml

      Filesize

      1KB

      MD5

      a8e40c8be27115ed372072b4609984ff

      SHA1

      5c7fc2af567cc564b6239298763e247a530d5a32

      SHA256

      32a75abbcb941e729468b815eadad00d4b51003cd49256f6aca929262c19dac3

      SHA512

      e607fa60e003f727789bd6ea3a317f9187ef453782b52d6d51044eac245941ada8b3a08b9b5b237aeff4a0182b7a9902254165473838ff55254344a71f786eea

    • \Users\Admin\AppData\Local\Temp\c207539996f18f579f3e0c09659b36d9.exe

      Filesize

      2.0MB

      MD5

      112b0c2e48130292f9be43f772fc8cc9

      SHA1

      7c0f31584a96cdc379b9ce34e8adb4f0af28eb0a

      SHA256

      dfa7d2389b2f01244ae0e2a95481cf678cbb9aed6f0954d5e3b2e86d09d190e3

      SHA512

      8d806ada9afbab94605b3c904893ed31a61d0e08518eb38ea7145be1ee2c9e30d7c3857ff62ac5f0d40cfb99d63702c1edbd06e73ca66e46f4b990050a1d41b0

    • memory/1976-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/1976-2-0x00000000002D0000-0x000000000034E000-memory.dmp

      Filesize

      504KB

    • memory/1976-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/1976-16-0x00000000232C0000-0x000000002351C000-memory.dmp

      Filesize

      2.4MB

    • memory/1976-15-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2556-20-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2556-22-0x00000000001A0000-0x000000000021E000-memory.dmp

      Filesize

      504KB

    • memory/2556-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2556-27-0x00000000002F0000-0x000000000035B000-memory.dmp

      Filesize

      428KB

    • memory/2556-54-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB