Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    38s
  • max time network
    72s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    24/08/2024, 23:06

General

  • Target

    d94eac76af4dcc102c986aa10f8954e0N.exe

  • Size

    6.4MB

  • MD5

    d94eac76af4dcc102c986aa10f8954e0

  • SHA1

    c2d627888aefca58c488c784fddd0f6b8ce36fa8

  • SHA256

    7394093efa830bc304c344d139b70efbeb956f0d623e46b31bef0313b161467f

  • SHA512

    0915826c926ee895bdf0272233e83e43d5545509d88bceb3607533160f0e6eedea68e72af479d60ae2635728f8044d385eeac01759610e396a2bbb9c14c5ddf3

  • SSDEEP

    196608:yulJqq/2dl6E1jWDCdlARVjjdl6E1jWDCdl72mU/dl6E1jWDCdlARVjjdl6E1jWZ:v/d6Ore6O2vUq6Ore6O9

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d94eac76af4dcc102c986aa10f8954e0N.exe
    "C:\Users\Admin\AppData\Local\Temp\d94eac76af4dcc102c986aa10f8954e0N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Users\Admin\AppData\Local\Temp\d94eac76af4dcc102c986aa10f8954e0N.exe
      C:\Users\Admin\AppData\Local\Temp\d94eac76af4dcc102c986aa10f8954e0N.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\d94eac76af4dcc102c986aa10f8954e0N.exe" /TN l8GsEBpfde6d /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2896
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN l8GsEBpfde6d > C:\Users\Admin\AppData\Local\Temp\8IdnpI.xml
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2444
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN l8GsEBpfde6d
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8bf788a804774702bf27139f7effd199

    SHA1

    ae81923918bc8c13738fb4a2a3001d2e3a44237b

    SHA256

    36bb0098a5103933ece31a7ea2c03749cd3ef500918abcbf8d3be13448dd94af

    SHA512

    f5ee82cb5ae0fdba1bf26ddbfa46916c324c6eb84fcd8ea02cbbd2ed6cd4dd8b7824aa6a9785152911fdd155e5f8e6841d3ab185aa37005165aef3843c08343a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e561a8276308063206e67c010b738382

    SHA1

    42f999cceabedc88faed0e0a54ba5bfbe4dd8e3c

    SHA256

    3229b442cad3cf94c1e2478025969b096fa4e251f07d5eb629879b119c30002b

    SHA512

    586e7fa425ba756db784ab66d2d2012d29cec4d5571bd2a9680ccb1bb9a65877bd1a5cc789957be835c416a4307f6a627367195ee4a0144d119e290cff9f4624

  • C:\Users\Admin\AppData\Local\Temp\8IdnpI.xml

    Filesize

    1KB

    MD5

    71ee1ec312cfbb8b39784725a5d7c2af

    SHA1

    83d36f294830908cbf2f43b2e207315bef138b60

    SHA256

    50c78d8767263fbb1dbca9d248592ec4ee6568fbcf8b1a9a185b51a1ebaca86e

    SHA512

    538bc0dd3ff21b0deebaea911a5a0cc75ae7d81e333a49fde798c1deb40bb3adccc8edf7941454ef693104ff2f05b11fc388fa810924fc2a4252bb725222b1dc

  • C:\Users\Admin\AppData\Local\Temp\Cab1650.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar1663.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\d94eac76af4dcc102c986aa10f8954e0N.exe

    Filesize

    6.4MB

    MD5

    cd26efb6fe75d73300aedd7170cd6472

    SHA1

    e7d874409ef809c3b76ca3f1846ec20f882edee0

    SHA256

    dee7d2b35e884e8079458f3459e4532eba855d5735570f0417bf7e6e76780853

    SHA512

    36f07050a3bda40c0bbddff233847ed1e0a44b644316098411d9e4b0bc13bc70458a3b72a656557d5441e674f132f2843f7289532f472e6da7addc665bc0b72f

  • memory/2160-37-0x0000000000400000-0x000000000065C000-memory.dmp

    Filesize

    2.4MB

  • memory/2160-24-0x00000000016D0000-0x000000000174E000-memory.dmp

    Filesize

    504KB

  • memory/2160-18-0x0000000000400000-0x000000000065C000-memory.dmp

    Filesize

    2.4MB

  • memory/2160-28-0x0000000000470000-0x00000000004DB000-memory.dmp

    Filesize

    428KB

  • memory/2160-26-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2380-36-0x0000000023BE0000-0x0000000023E3C000-memory.dmp

    Filesize

    2.4MB

  • memory/2380-0-0x0000000000400000-0x000000000065C000-memory.dmp

    Filesize

    2.4MB

  • memory/2380-17-0x0000000023BE0000-0x0000000023E3C000-memory.dmp

    Filesize

    2.4MB

  • memory/2380-15-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB

  • memory/2380-9-0x0000000000210000-0x000000000028E000-memory.dmp

    Filesize

    504KB

  • memory/2380-1-0x0000000000400000-0x000000000046B000-memory.dmp

    Filesize

    428KB