Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/03/2024, 16:00

General

  • Target

    d686fe54ea3e3b495fde0f7ca729d87e.exe

  • Size

    907KB

  • MD5

    d686fe54ea3e3b495fde0f7ca729d87e

  • SHA1

    d77e8fe96ad56cceafb146d8da784e6e7ff5297b

  • SHA256

    0b6e8348423049536a26437794b79fb46889acd18f4337fb5f699de8c053a049

  • SHA512

    0c7d1598ea12439de8e91184f5b2b3103bcfa5f28576f78ecf16b920cbcd4d47d91ee47d8504de413c75932d0ff1f6669668ae6d7ab360e19c9fe8d708fc5565

  • SSDEEP

    24576:IVrQ7QpsYW64z43g9OBRmFBhHGeAxIxNZZOMblnQha/ZS1:AQ7QG64z43g9OfobHGTxIxNZcMggS

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d686fe54ea3e3b495fde0f7ca729d87e.exe
    "C:\Users\Admin\AppData\Local\Temp\d686fe54ea3e3b495fde0f7ca729d87e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Temp\d686fe54ea3e3b495fde0f7ca729d87e.exe
      C:\Users\Admin\AppData\Local\Temp\d686fe54ea3e3b495fde0f7ca729d87e.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:3032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

  • C:\Users\Admin\AppData\Local\Temp\Tar6D1C.tmp

    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

  • C:\Users\Admin\AppData\Local\Temp\d686fe54ea3e3b495fde0f7ca729d87e.exe

    Filesize

    907KB

    MD5

    0969b293b78d341e8fe038511fe1e093

    SHA1

    18b0f4b62b1366371b75e1d5264498f08507907a

    SHA256

    e602b8dc9de287000447f40a745eaac312d0e4ce8f0947eba24de77826a06756

    SHA512

    21f69828bfcb9f40534be6b17eea2a6e310ab063153a602b759de0b009724b8f8db48a2f5827beaa95465182ea872f8cebf966f7ab3e943762e22efd239f18fe

  • \Users\Admin\AppData\Local\Temp\d686fe54ea3e3b495fde0f7ca729d87e.exe

    Filesize

    896KB

    MD5

    92c8c800bb43933190f160f16a6d4211

    SHA1

    46ad8cf45041a536ab73ea2b8066be9a6fd24385

    SHA256

    46abb208e7ebc5710a9da670d9efb07444bf4f87519ccfb49999c603cb1c2572

    SHA512

    08c74822abbc8f379843e18c2db921b05a676a535b0c1c1861192f6e7b06425c4f83474bcf772b78097feb6333e4c04bc9261fedaf8aa10895db9f9cbdf9d744

  • memory/2488-13-0x0000000000400000-0x00000000004BB000-memory.dmp

    Filesize

    748KB

  • memory/2488-0-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

  • memory/2488-1-0x0000000000400000-0x00000000004BB000-memory.dmp

    Filesize

    748KB

  • memory/2488-2-0x00000000002B0000-0x0000000000398000-memory.dmp

    Filesize

    928KB

  • memory/3032-15-0x0000000000400000-0x00000000004E8000-memory.dmp

    Filesize

    928KB

  • memory/3032-16-0x00000000014F0000-0x00000000015D8000-memory.dmp

    Filesize

    928KB

  • memory/3032-22-0x0000000000400000-0x0000000000498000-memory.dmp

    Filesize

    608KB

  • memory/3032-27-0x0000000002EF0000-0x0000000002FAB000-memory.dmp

    Filesize

    748KB

  • memory/3032-80-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/3032-83-0x000000000EC20000-0x000000000ECB8000-memory.dmp

    Filesize

    608KB