Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18/03/2024, 17:05
Behavioral task
behavioral1
Sample
d40d59b1ec9e2cdc48978a48f862bab5.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d40d59b1ec9e2cdc48978a48f862bab5.exe
Resource
win10v2004-20240226-en
General
-
Target
d40d59b1ec9e2cdc48978a48f862bab5.exe
-
Size
3.9MB
-
MD5
d40d59b1ec9e2cdc48978a48f862bab5
-
SHA1
6c3b1b4cf58bfff680e378417ffb05f0f9026324
-
SHA256
7886aade8eadc68c1081dc2419c0f73fdeae1769719f9e913c2fcacc35955991
-
SHA512
d0483de841a452e87cd25e48af8881b9a1d8b297e70c2f42d98e5e357d918db7138048f72f6331ca45c0c50f9b653bf4ebdee9814621aed9ac50beeffba8a452
-
SSDEEP
98304:VCgbHrSa1ixUl1mcakcibiqhAzvN5wxJccakcibiqhaFZUFZmh49TUXcakcibiqn:VzbLSwfmdlirUNSOdlir8zwtTUXdlirB
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2228 d40d59b1ec9e2cdc48978a48f862bab5.exe -
Executes dropped EXE 1 IoCs
pid Process 2228 d40d59b1ec9e2cdc48978a48f862bab5.exe -
Loads dropped DLL 1 IoCs
pid Process 2264 d40d59b1ec9e2cdc48978a48f862bab5.exe -
resource yara_rule behavioral1/memory/2264-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/files/0x000d0000000122a8-11.dat upx behavioral1/memory/2264-16-0x0000000023590000-0x00000000237EC000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 2 pastebin.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2648 schtasks.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 d40d59b1ec9e2cdc48978a48f862bab5.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 d40d59b1ec9e2cdc48978a48f862bab5.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 d40d59b1ec9e2cdc48978a48f862bab5.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 d40d59b1ec9e2cdc48978a48f862bab5.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2264 d40d59b1ec9e2cdc48978a48f862bab5.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2264 d40d59b1ec9e2cdc48978a48f862bab5.exe 2228 d40d59b1ec9e2cdc48978a48f862bab5.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2228 2264 d40d59b1ec9e2cdc48978a48f862bab5.exe 29 PID 2264 wrote to memory of 2228 2264 d40d59b1ec9e2cdc48978a48f862bab5.exe 29 PID 2264 wrote to memory of 2228 2264 d40d59b1ec9e2cdc48978a48f862bab5.exe 29 PID 2264 wrote to memory of 2228 2264 d40d59b1ec9e2cdc48978a48f862bab5.exe 29 PID 2228 wrote to memory of 2648 2228 d40d59b1ec9e2cdc48978a48f862bab5.exe 30 PID 2228 wrote to memory of 2648 2228 d40d59b1ec9e2cdc48978a48f862bab5.exe 30 PID 2228 wrote to memory of 2648 2228 d40d59b1ec9e2cdc48978a48f862bab5.exe 30 PID 2228 wrote to memory of 2648 2228 d40d59b1ec9e2cdc48978a48f862bab5.exe 30 PID 2228 wrote to memory of 2744 2228 d40d59b1ec9e2cdc48978a48f862bab5.exe 32 PID 2228 wrote to memory of 2744 2228 d40d59b1ec9e2cdc48978a48f862bab5.exe 32 PID 2228 wrote to memory of 2744 2228 d40d59b1ec9e2cdc48978a48f862bab5.exe 32 PID 2228 wrote to memory of 2744 2228 d40d59b1ec9e2cdc48978a48f862bab5.exe 32 PID 2744 wrote to memory of 2696 2744 cmd.exe 34 PID 2744 wrote to memory of 2696 2744 cmd.exe 34 PID 2744 wrote to memory of 2696 2744 cmd.exe 34 PID 2744 wrote to memory of 2696 2744 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\d40d59b1ec9e2cdc48978a48f862bab5.exe"C:\Users\Admin\AppData\Local\Temp\d40d59b1ec9e2cdc48978a48f862bab5.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\d40d59b1ec9e2cdc48978a48f862bab5.exeC:\Users\Admin\AppData\Local\Temp\d40d59b1ec9e2cdc48978a48f862bab5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\d40d59b1ec9e2cdc48978a48f862bab5.exe" /TN 6ek6uOO9da42 /F3⤵
- Creates scheduled task(s)
PID:2648
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN 6ek6uOO9da42 > C:\Users\Admin\AppData\Local\Temp\KF3aKn.xml3⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN 6ek6uOO9da424⤵PID:2696
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d78dab1c724e29a2149e17073103a44f
SHA1d44bf90e08cbb13c2594bb6c5d39f33cff8244f1
SHA2560a2b77852730f1b242d718c17a23c9b1c82b4e2f4abb64b3eaf30b893bcae9e2
SHA51246096a8248783448a873b399f9975db7eb5b42777ed7f7318958bba39e31130792857fb33167d2f91ba3d721bb58e14e1b37844e4655f29cbed4c9363f8c9ab9
-
Filesize
3.9MB
MD56d377a6bc268fa95c83f8afdbac4739c
SHA1d41e942b537df3477a9e19c65739403ab947d6d5
SHA256c0619d47d38eaa4bc6679148f67fa1c54dce5bfd224083fd22864d13e2a38604
SHA512ee79f1b603bd33fc5f549bd7e21056106e7c76b7857e5d0246fba4e467e8f53187ec7c2f647fd3dd1215b10917f762bd4379a1f079cf11af6b7bb281891e5bf0