Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    212s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2022, 16:54

General

  • Target

    Install.exe

  • Size

    715.3MB

  • MD5

    71c8dbd53f77777dcc663c9bce5fe588

  • SHA1

    66008a2ceac550c246645ff2d33734014645a8bb

  • SHA256

    fc7b3fd579e40a691cddecc9eb413996d30ddbd8d78a9e483d015f09510fde1c

  • SHA512

    ae972a7c810e59f3a566938f1a67c46c373ccd895ed6cd96fa87fba79ca60392bbf65913029ed9b671e4cbea8dfc47f4817a67734b60840fee03c816f5d62aef

  • SSDEEP

    98304:gUgVBq1XrkDRvTH++2LDyli5l1H6lGGu6xuojjObjGsM5vCFKTyw:gUaBkQV+3LDyW6lGZrojj8nsaKT5

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install.exe
    "C:\Users\Admin\AppData\Local\Temp\Install.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\Pictures\Minor Policy\EPVWB1AChGkbWkgiPy1MbHTw.exe
      "C:\Users\Admin\Pictures\Minor Policy\EPVWB1AChGkbWkgiPy1MbHTw.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1144
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAyAA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1928
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        3⤵
          PID:1628
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          3⤵
            PID:584
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            3⤵
            • Loads dropped DLL
            • Checks processor information in registry
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:920

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        340B

        MD5

        893a97dfd30c11fc6f6ab072340d0569

        SHA1

        583bb495b8c9b4f8a0eb8f49cd884e801fab340c

        SHA256

        c88ba5ab383f5ce0ac16174c8b8f04de813347f2a14ac6fc93377714e751d76f

        SHA512

        335f73d0daf1d8452eb3362b71939024c13a9223d868f38154e7222bc5ab319c180dbc79c846bca11c025303364fae1c1c3fdd0bd0ddb7ac1a003f69cf00d2d5

      • C:\Users\Admin\Pictures\Minor Policy\EPVWB1AChGkbWkgiPy1MbHTw.exe

        Filesize

        192KB

        MD5

        4842462b1ff7ae5e3f527a9e30d36102

        SHA1

        290f6eb8a1b7cbc620d638029497eb2d20d32bfe

        SHA256

        dc1434e6bd3de66b0bcc6f06d93c68ce95a5c6699445f2adc5d673cc1ad73c68

        SHA512

        3dd8a5abc34402f6e00b763f1d907c460ffe0b14defcf2dbc8587ee95d50c2cd22ebcaf7d8a0f6a415518c11667f827acf419ced66ed95f1e5464317297f601b

      • C:\Users\Admin\Pictures\Minor Policy\EPVWB1AChGkbWkgiPy1MbHTw.exe

        Filesize

        192KB

        MD5

        4842462b1ff7ae5e3f527a9e30d36102

        SHA1

        290f6eb8a1b7cbc620d638029497eb2d20d32bfe

        SHA256

        dc1434e6bd3de66b0bcc6f06d93c68ce95a5c6699445f2adc5d673cc1ad73c68

        SHA512

        3dd8a5abc34402f6e00b763f1d907c460ffe0b14defcf2dbc8587ee95d50c2cd22ebcaf7d8a0f6a415518c11667f827acf419ced66ed95f1e5464317297f601b

      • \ProgramData\mozglue.dll

        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      • \ProgramData\nss3.dll

        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      • \ProgramData\sqlite3.dll

        Filesize

        1.1MB

        MD5

        1f44d4d3087c2b202cf9c90ee9d04b0f

        SHA1

        106a3ebc9e39ab6ddb3ff987efb6527c956f192d

        SHA256

        4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260

        SHA512

        b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45

      • \Users\Admin\Pictures\Minor Policy\EPVWB1AChGkbWkgiPy1MbHTw.exe

        Filesize

        192KB

        MD5

        4842462b1ff7ae5e3f527a9e30d36102

        SHA1

        290f6eb8a1b7cbc620d638029497eb2d20d32bfe

        SHA256

        dc1434e6bd3de66b0bcc6f06d93c68ce95a5c6699445f2adc5d673cc1ad73c68

        SHA512

        3dd8a5abc34402f6e00b763f1d907c460ffe0b14defcf2dbc8587ee95d50c2cd22ebcaf7d8a0f6a415518c11667f827acf419ced66ed95f1e5464317297f601b

      • memory/920-88-0x0000000000400000-0x000000000045E000-memory.dmp

        Filesize

        376KB

      • memory/920-89-0x0000000000400000-0x000000000045E000-memory.dmp

        Filesize

        376KB

      • memory/920-85-0x0000000000400000-0x000000000045E000-memory.dmp

        Filesize

        376KB

      • memory/920-82-0x0000000000400000-0x000000000045E000-memory.dmp

        Filesize

        376KB

      • memory/920-80-0x0000000000400000-0x000000000045E000-memory.dmp

        Filesize

        376KB

      • memory/920-78-0x0000000000400000-0x000000000045E000-memory.dmp

        Filesize

        376KB

      • memory/920-76-0x0000000000400000-0x000000000045E000-memory.dmp

        Filesize

        376KB

      • memory/920-73-0x0000000000400000-0x000000000045E000-memory.dmp

        Filesize

        376KB

      • memory/920-74-0x0000000000400000-0x000000000045E000-memory.dmp

        Filesize

        376KB

      • memory/1144-68-0x0000000004FC0000-0x0000000005052000-memory.dmp

        Filesize

        584KB

      • memory/1144-67-0x0000000005480000-0x0000000005568000-memory.dmp

        Filesize

        928KB

      • memory/1144-64-0x0000000000DD0000-0x0000000000E06000-memory.dmp

        Filesize

        216KB

      • memory/1712-54-0x0000000075451000-0x0000000075453000-memory.dmp

        Filesize

        8KB

      • memory/1712-66-0x0000000000CD0000-0x0000000001792000-memory.dmp

        Filesize

        10.8MB

      • memory/1712-59-0x0000000000CD0000-0x0000000001792000-memory.dmp

        Filesize

        10.8MB

      • memory/1712-58-0x0000000000CD0000-0x0000000001792000-memory.dmp

        Filesize

        10.8MB

      • memory/1712-55-0x0000000000CD0000-0x0000000001792000-memory.dmp

        Filesize

        10.8MB

      • memory/1928-72-0x000000006F710000-0x000000006FCBB000-memory.dmp

        Filesize

        5.7MB

      • memory/1928-71-0x000000006F710000-0x000000006FCBB000-memory.dmp

        Filesize

        5.7MB