Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 17:02

General

  • Target

    00c759af590238b4c0e51d3b128d74b896bada592b015be63577d03c42956b24.exe

  • Size

    58KB

  • MD5

    a1fad08826b8fe95a7c226adf3d486a0

  • SHA1

    aed87097358bd47de493900263f3f014526fccb1

  • SHA256

    00c759af590238b4c0e51d3b128d74b896bada592b015be63577d03c42956b24

  • SHA512

    8c8af1abd779f218feaa476bec179f3748d5ab04da61dbefd001da0044e964a4273f291d85880a2705fed34fc0e013d6ff6718820d2b4ca16dad69943fea2395

  • SSDEEP

    384:5ItlYLkfSoxGMwIfUzAI7+U5QY8PfOc9cCWRLzENdloN1T8F0pEEu6AZkSX3uo9n:5+CLZoyIm5Vz2srIFLI63VvKP3KfiSiS

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00c759af590238b4c0e51d3b128d74b896bada592b015be63577d03c42956b24.exe
    "C:\Users\Admin\AppData\Local\Temp\00c759af590238b4c0e51d3b128d74b896bada592b015be63577d03c42956b24.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe
      "C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:2944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hhcbrnaff.exe

    Filesize

    58KB

    MD5

    500768769000cd2dc9a05d9419016c02

    SHA1

    36243d3af3460846aa60dfb795ec9fec53f7e0e5

    SHA256

    7db3d06b719d69cb6e79a7650d0737e987b27f9476ea04759d930c85b9a0d3c5

    SHA512

    29974b4b6bb3a8d49e71b2653d567c80cb95dc326ea1bb27e17443d587de74cda3df75ed302f32d49bb47c8b62fced1b582438763b6e9c10bef21d2ef4f684d8

  • memory/2944-11-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/2944-13-0x0000000002D50000-0x0000000002D51000-memory.dmp

    Filesize

    4KB

  • memory/2944-14-0x0000000002D60000-0x0000000003160000-memory.dmp

    Filesize

    4.0MB

  • memory/2944-29-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/3040-0-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/3040-2-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

    Filesize

    4KB

  • memory/3040-4-0x0000000002CF0000-0x00000000030F0000-memory.dmp

    Filesize

    4.0MB

  • memory/3040-10-0x0000000002CC0000-0x0000000002CCD000-memory.dmp

    Filesize

    52KB

  • memory/3040-9-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB