Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    36s
  • max time network
    66s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 22:00

General

  • Target

    23fa4286ebd1ab5f89e5052692b3d4b0N.exe

  • Size

    501KB

  • MD5

    23fa4286ebd1ab5f89e5052692b3d4b0

  • SHA1

    11d8684e778d53dd8db97c9029c7db097b9e4771

  • SHA256

    add21e05e98604929038b131b2d0be3d5ca3e1463d7e81589b27828e6b2f509b

  • SHA512

    c88e60d1eae82c6e180213270b1dbba9a545a1318f9796bea797a5f2f7da64151ce0effad709d35021122bba4011677ed115ab2d0f5e7eed4a1c4bfff95be365

  • SSDEEP

    12288:0UKMeQiwQSwCfodYgMD/G3hu/Gg5p+ou/Tco7u4Li:0Uw1wQSwCGE/I8b+LI2

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23fa4286ebd1ab5f89e5052692b3d4b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\23fa4286ebd1ab5f89e5052692b3d4b0N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Users\Admin\AppData\Local\Temp\23fa4286ebd1ab5f89e5052692b3d4b0N.exe
      C:\Users\Admin\AppData\Local\Temp\23fa4286ebd1ab5f89e5052692b3d4b0N.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2080
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\23fa4286ebd1ab5f89e5052692b3d4b0N.exe" /TN Mk5F3CJT08f3 /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2428
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN Mk5F3CJT08f3 > C:\Users\Admin\AppData\Local\Temp\ZSkmGW.xml
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1788
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN Mk5F3CJT08f3
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d06655c8e90bef5c0f71e205b07bd166

    SHA1

    a09a53737d418d0a9c0893e547ba82f319f76929

    SHA256

    b476a94e4e2e54b3fccd109c343ef13b267ad4a38b25f423f1d94deada22253a

    SHA512

    2c6ceda381a3c251305c90cb896464307e1eec995c24c5dee70bcfdb4444a5130204089644df8a2f465425fc46ea47c899c472102239932d8a7d118e1d679728

  • C:\Users\Admin\AppData\Local\Temp\23fa4286ebd1ab5f89e5052692b3d4b0N.exe

    Filesize

    501KB

    MD5

    51831210f03d6322e08968a6c8792934

    SHA1

    e60171d6c848a0e925521debb689e4c989485449

    SHA256

    16f34f91240beefd54afbe5419bc054ddd838650e755eb43016b8e1ddbac331c

    SHA512

    31f024dae4dc4575981b18c0304ff9f9d54e55bf25713b9961d31b909eab4cf2461a78e96e4bba6cd62c30e36e3f21369e8561a266df30ae508c48b833f78911

  • C:\Users\Admin\AppData\Local\Temp\CabC0A3.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarC0B5.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\ZSkmGW.xml

    Filesize

    1KB

    MD5

    7e7f1d374b6c634c253347118d220cf8

    SHA1

    9616337bb5bd8e54253272e0f8dfd865612b7af8

    SHA256

    9b07d3d31dba2a401fb81f3489d544aa1244867c10cbc1f4b4187bc2a4bf739e

    SHA512

    5c4cc10093786b60741311bd7666d4cbeb530d8378494d4187377b116e1a13ef8c70dd8219de3484a13c7f04d173f73c2ab03cab159dcbefffd868209534dbdb

  • memory/2080-29-0x0000000000300000-0x000000000036B000-memory.dmp

    Filesize

    428KB

  • memory/2080-28-0x0000000000400000-0x000000000065C000-memory.dmp

    Filesize

    2.4MB

  • memory/2080-23-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2080-30-0x00000000001A0000-0x000000000021E000-memory.dmp

    Filesize

    504KB

  • memory/2080-125-0x0000000000400000-0x000000000065C000-memory.dmp

    Filesize

    2.4MB

  • memory/2104-0-0x0000000000400000-0x000000000065C000-memory.dmp

    Filesize

    2.4MB

  • memory/2104-1-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

  • memory/2104-14-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

  • memory/2104-15-0x00000000001A0000-0x000000000021E000-memory.dmp

    Filesize

    504KB