Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/03/2024, 20:56

General

  • Target

    c6d72fdd83c4bf43a885c9384400e779.exe

  • Size

    133KB

  • MD5

    c6d72fdd83c4bf43a885c9384400e779

  • SHA1

    e587b01ce44d01939f5a405657e3bbde3c37779f

  • SHA256

    ed7cbb94e825e9797edbd8a10cdeeee60cba29cdf8e9d5dc3b5d2efb98332bb1

  • SHA512

    5e74845c980d4888ace4191f101de565fe9c79421a7936cbbe8ca2624685dce82d0b5f4e99abe04b2bd4bafc391477da6651a61dee4d6b78c59658ce73a6f480

  • SSDEEP

    3072:bQE5o05oZ30ZBl7Gw+oBTsGgXXHhgETdsLjL9Q:bQf05ZrOo1sGgnhTKLjBQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6d72fdd83c4bf43a885c9384400e779.exe
    "C:\Users\Admin\AppData\Local\Temp\c6d72fdd83c4bf43a885c9384400e779.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Users\Admin\AppData\Local\Temp\c6d72fdd83c4bf43a885c9384400e779.exe
      C:\Users\Admin\AppData\Local\Temp\c6d72fdd83c4bf43a885c9384400e779.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\c6d72fdd83c4bf43a885c9384400e779.exe

    Filesize

    133KB

    MD5

    636212f46b1d46ab7025c7acd079c8d0

    SHA1

    139d6e2901d8c194573286dd90ce4b377465fca5

    SHA256

    ebf08408d5438687609aedab39c724d67258d43a2283609c08bd87f2109bc399

    SHA512

    eef4c25d856aefe5863531b12ac777b17bb503e7a47a285c08771f043458df7d5895777a4e174fe1e7df8907fa1f1d61054751ab56c24ae277a70224b24a90bf

  • memory/1780-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/1780-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1780-1-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/1780-15-0x0000000000210000-0x0000000000296000-memory.dmp

    Filesize

    536KB

  • memory/1780-14-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2652-18-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2652-20-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2652-43-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB