Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 04:52
Static task
static1
Behavioral task
behavioral1
Sample
e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe
Resource
win10v2004-20240226-en
General
-
Target
e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe
-
Size
4.6MB
-
MD5
e0d18ca93ad7ce55c1d8de4f06cfd4d3
-
SHA1
a43f0e63630e32755dc5940f2f5b0947cba915ce
-
SHA256
9529272735e60b1640ddafa4c73aec9f0a8dbceef790402e7632899597cdec17
-
SHA512
3a4ad66f135c06d46f77c23aa99325c45ab820da8bfa9388c30634ec48d59e04a5c133a7b1ce386d024f44ec35a55c0decd3a661f1285b4fe0be6ee2ecf6c8b9
-
SSDEEP
49152:zq4Z04vjXcMgygRbNsm+kwjK23gygRbO9ZP+eekgygRbNsm+kwjK23gygRbD:e42Zshu4+pZshuH
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2940 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe -
Executes dropped EXE 1 IoCs
pid Process 2940 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe -
Loads dropped DLL 1 IoCs
pid Process 2456 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 pastebin.com 5 pastebin.com -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2940 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2456 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2940 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2940 2456 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe 29 PID 2456 wrote to memory of 2940 2456 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe 29 PID 2456 wrote to memory of 2940 2456 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe 29 PID 2456 wrote to memory of 2940 2456 e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe"C:\Users\Admin\AppData\Local\Temp\e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\e0d18ca93ad7ce55c1d8de4f06cfd4d3.exeC:\Users\Admin\AppData\Local\Temp\e0d18ca93ad7ce55c1d8de4f06cfd4d3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
784KB
MD52e7684c3910d56b8ccdf9c96c543f14a
SHA1d6843b16cbaa1ad2992fe3ac3c47bb8780d251df
SHA256f309ae9aaf66ddf5a48f78f59bf228893c9e94d1d00e2a587dc3c44c02408d88
SHA512c9500248226c01c97bba448c61d9ba85c27e9e900bc9eac8c774507398d8ac0f01a4624378efab2c574cb62686f9a232c26af9fc2872a5658e62f9d19df6843d
-
Filesize
1.1MB
MD55c9dc743f2cdf03e7b7463da0a98e3eb
SHA1f68a14adc0f76878d132dc9dbd135a774e1e2b55
SHA2566f9c685a4352d5acaf8123c081565cf258230776772076121d477b675be80357
SHA512a59125c6d12825aed0abea583887d0864772fcd924d083aed7a83a9d46f20709896294fd755714379987832b22d2f8ab5d845b7a455c9e35cc6834909e0c20db