Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2024, 19:39

General

  • Target

    c973fa7527655b6654c0b9ff6869a3b7.exe

  • Size

    7.8MB

  • MD5

    c973fa7527655b6654c0b9ff6869a3b7

  • SHA1

    c33c8eb2b6503d035b212bb6d77c1151296ce3ad

  • SHA256

    ef526dc295bc08acbed0469ea794a5cca7d606299b91691fcd064337ec2ededc

  • SHA512

    18c300606d8f43b881e09f5e62a180090cb48685ff5bc25fd8445b62ba373e5a0bbceb2ca05e7d794dda504b1a6e0eb948f6c16bae7f9bde9306f9987be5d114

  • SSDEEP

    196608:e+Zvfdlir8eCdlirl1aXdlir8eCdlirjE4XP1Dypdlir8eCdlirl1aXdlir8eCdE:ewvtTGEmwzT

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe
    "C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe
      C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe" /TN v8Zki9cgdb8d /F
        3⤵
        • Creates scheduled task(s)
        PID:4500
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN v8Zki9cgdb8d > C:\Users\Admin\AppData\Local\Temp\cWnJU.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN v8Zki9cgdb8d
          4⤵
            PID:1812

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\c973fa7527655b6654c0b9ff6869a3b7.exe

      Filesize

      7.8MB

      MD5

      6eab64b3bcf1074ab7219b58b655ed69

      SHA1

      8d1221eafe0989e70b6414cd8f753838e96e1073

      SHA256

      bd48926b3154ab1d14dff05df9efd204bc684e51ab8d22d07cbb1e6874d5c602

      SHA512

      5e7c48b288adaf4dc135e7fc9ebf373529f2226f3bbfb9af97d93b6131d67ff6cdc1e8f8a8d969d4dac594e99678f352e8fa4b579046c48792d21d571cfc645f

    • C:\Users\Admin\AppData\Local\Temp\cWnJU.xml

      Filesize

      1KB

      MD5

      5f760a6fa93b8c930ec125259694c6c6

      SHA1

      e4f8912156a9aed261d20514708bc00ec33e305e

      SHA256

      986dba945d1baeaa0923d7ca8f12aa7d5b532642463b1d1f49fd7ce964872174

      SHA512

      3f8be3aefe34ea0c24ae3a798ccdced82fad404fa2b9328e2aff2b6c8d6dd2088789e1daf2cedf887f02fd0b5c8070ea42535c7cb07478b4f6fba89554f3e798

    • memory/2512-15-0x0000000023FB0000-0x000000002402E000-memory.dmp

      Filesize

      504KB

    • memory/2512-17-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2512-23-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2512-22-0x00000000004B0000-0x000000000051B000-memory.dmp

      Filesize

      428KB

    • memory/2512-41-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/4044-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/4044-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/4044-4-0x0000000001660000-0x00000000016DE000-memory.dmp

      Filesize

      504KB

    • memory/4044-13-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB