Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 19:39

General

  • Target

    c973fa7527655b6654c0b9ff6869a3b7.exe

  • Size

    7.8MB

  • MD5

    c973fa7527655b6654c0b9ff6869a3b7

  • SHA1

    c33c8eb2b6503d035b212bb6d77c1151296ce3ad

  • SHA256

    ef526dc295bc08acbed0469ea794a5cca7d606299b91691fcd064337ec2ededc

  • SHA512

    18c300606d8f43b881e09f5e62a180090cb48685ff5bc25fd8445b62ba373e5a0bbceb2ca05e7d794dda504b1a6e0eb948f6c16bae7f9bde9306f9987be5d114

  • SSDEEP

    196608:e+Zvfdlir8eCdlirl1aXdlir8eCdlirjE4XP1Dypdlir8eCdlirl1aXdlir8eCdE:ewvtTGEmwzT

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe
    "C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe
      C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3056
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe" /TN 6ek6uOO9da42 /F
        3⤵
        • Creates scheduled task(s)
        PID:2600
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN 6ek6uOO9da42 > C:\Users\Admin\AppData\Local\Temp\5nstd.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN 6ek6uOO9da42
          4⤵
            PID:2912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\5nstd.xml

      Filesize

      1KB

      MD5

      9275f906dda076bbee7e00c02073d243

      SHA1

      01c844aa27ccf1868f7bd2affc3b63b3033a3c78

      SHA256

      507504cf600e43514f9a0cb11e94e79277d3b15002d8b4f2608e86b7b047fbc6

      SHA512

      c15ec3d1c23860045d352df4c3215e6988c465e518eef3a981d51e51cf531933d4efd8b087f2535d2f29cc3bd2a37f87b1379265bb21e43a290d5a8b8eb5971b

    • C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe

      Filesize

      7.8MB

      MD5

      5b15aafcd6016f9fa39b111ba1ef1286

      SHA1

      b4bf7b7b2441a90c5164d2d4a618ce5ef5a3ef31

      SHA256

      9c06ce525467f485530495a677e1d8b2e7daaae587d3678b0241000fee93e22e

      SHA512

      314dc2d49b48cd9c8c60c79a4b02a0f541ea66e938d5e47dfb102198232cbd59bb7ebc1cd5e7907f417bbfcd3a452781235948bfdf974416e069138a8c61738a

    • \Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe

      Filesize

      6.2MB

      MD5

      06b9ca98b5a26d2319ef37ca32590b0e

      SHA1

      28681b21e6be872455a51f4c2223e24ac3ecd6f4

      SHA256

      4bcf42eba0cd2431b851d7f6f450e8b974dcc4ffe73f2db0c6b59de20b3aa6cf

      SHA512

      1ffd7ffc0b7cd3bbb958628dd48e8a0bc2ce1fe9e70dbcaf911b1efc47435029a845d732f9fe1902b4fb998b7adc1fbaf70f39273d9193a86f7c42eeeba96b2e

    • memory/2360-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2360-2-0x0000000000380000-0x00000000003FE000-memory.dmp

      Filesize

      504KB

    • memory/2360-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2360-16-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/3056-17-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/3056-19-0x0000000001660000-0x00000000016DE000-memory.dmp

      Filesize

      504KB

    • memory/3056-25-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/3056-30-0x0000000000470000-0x00000000004DB000-memory.dmp

      Filesize

      428KB

    • memory/3056-44-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB