Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12/03/2024, 04:01

General

  • Target

    c266caf54aa122de48c69f3f8f446c2a.exe

  • Size

    5.0MB

  • MD5

    c266caf54aa122de48c69f3f8f446c2a

  • SHA1

    f544763402b4b77eb2f1df7181e41528fce924e2

  • SHA256

    2c8c5deeba530582fe619855cd2ce6a6da4f60dbcc9f9efb408933a91ffe7657

  • SHA512

    c3ee0c1bffc5e3546f294cfefc46d50948107ed46c6877769b96357442a83d0d7ceb1dd497ef07d2df7ebe1bc445d4b32a38b122db337012622c88ce208f4b64

  • SSDEEP

    49152:nBcLfqh12vWDdo1bIlNdsdAiEcIrdFwXV1AcRRaod:+E13dGE56VErMt

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c266caf54aa122de48c69f3f8f446c2a.exe
    "C:\Users\Admin\AppData\Local\Temp\c266caf54aa122de48c69f3f8f446c2a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\c266caf54aa122de48c69f3f8f446c2a.exe
      C:\Users\Admin\AppData\Local\Temp\c266caf54aa122de48c69f3f8f446c2a.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\c266caf54aa122de48c69f3f8f446c2a.exe

    Filesize

    768KB

    MD5

    db038ec83fa64d99af350226215716c0

    SHA1

    0f134a05739ae656e8fbf01ed428c6f9ef26a126

    SHA256

    1914f6476d010f942223c73f70a0cf3eea1c90e51677bcee329b422090258bab

    SHA512

    be0c82a6293ad7af6bca87508605e9ba6a66f7475f77cd16eb1667773b8b64fc6e00ffaa98553c9e4563d1f73793171e5f32f1423a1e4a664b4c54aba2c96a8f

  • \Users\Admin\AppData\Local\Temp\c266caf54aa122de48c69f3f8f446c2a.exe

    Filesize

    960KB

    MD5

    e0e65468d97f04e953faa602ffc9d37f

    SHA1

    450a7200c85c15216eda076529efe46bfb47124b

    SHA256

    d640685fb2442b8d9b975a662de09446a266507f8090d693b4ca3e8611cd805c

    SHA512

    85d3766948163ad81c424629cbe16f27a5a48dd5540ecce000cc1028a018d1f92dbba1a2119a59f6cd682151708d51a52d229fc96884615331bb0171d72b2e6e

  • memory/1676-1-0x0000000000400000-0x0000000000CE1000-memory.dmp

    Filesize

    8.9MB

  • memory/1676-3-0x0000000001EE0000-0x000000000210E000-memory.dmp

    Filesize

    2.2MB

  • memory/1676-0-0x0000000000400000-0x00000000005EF000-memory.dmp

    Filesize

    1.9MB

  • memory/1676-16-0x0000000003F30000-0x0000000004811000-memory.dmp

    Filesize

    8.9MB

  • memory/1676-15-0x0000000000400000-0x00000000005EF000-memory.dmp

    Filesize

    1.9MB

  • memory/2016-19-0x0000000000400000-0x0000000000CE1000-memory.dmp

    Filesize

    8.9MB

  • memory/2016-21-0x0000000002110000-0x000000000233E000-memory.dmp

    Filesize

    2.2MB

  • memory/2016-43-0x0000000000400000-0x0000000000CE1000-memory.dmp

    Filesize

    8.9MB