Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 03:33

General

  • Target

    48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe

  • Size

    361KB

  • MD5

    3330dff3bb8dd353c16ee716753c8287

  • SHA1

    5896aa699c878b101f787b2f1ce9a7c001bca55f

  • SHA256

    48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359

  • SHA512

    3e9485665d5ffe795a171634374f0558affdabeb823d52299b879212e233c5b70c5563b476c9c1df79ac5f6557a1b986a9683f1a7f6f4aefc0f7fc5c282b5697

  • SSDEEP

    6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe
    "C:\Users\Admin\AppData\Local\Temp\48fd662090422075c969cba7e9bb931105d50ce3e7369834e86890fb08df4359.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:532
    • C:\Temp\cxtpldrnjeathcyu.exe
      C:\Temp\cxtpldrnjeathcyu.exe run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\rolheauqnk.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:612
        • C:\Temp\rolheauqnk.exe
          C:\Temp\rolheauqnk.exe ups_run
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:432
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1100
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1552
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1700

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    d0bc79e37348f260253b6d22bdcf7825

    SHA1

    9802ff19aa6196b8b2b7f2c33ce6d112c78c65b1

    SHA256

    810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344

    SHA512

    bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29

  • C:\Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    d0bc79e37348f260253b6d22bdcf7825

    SHA1

    9802ff19aa6196b8b2b7f2c33ce6d112c78c65b1

    SHA256

    810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344

    SHA512

    bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29

  • C:\Temp\cxtpldrnjeathcyu.exe

    Filesize

    361KB

    MD5

    0e79161b4b04056c3669ae38c9ddf7c8

    SHA1

    d15c043eebc3c6b48804e7281035abe4746483fd

    SHA256

    3f52a7e18c301145759087bca0e25f84da1b3a8134a8520ea232fd50aa175291

    SHA512

    7193607ff258ea73f727c84d154fc428e8cd027ff45e4975568703e8a7d07e0816e8e43827db3151f8204c2d5b10ea63c81ae48e3156d959651456eff7c195db

  • C:\Temp\cxtpldrnjeathcyu.exe

    Filesize

    361KB

    MD5

    0e79161b4b04056c3669ae38c9ddf7c8

    SHA1

    d15c043eebc3c6b48804e7281035abe4746483fd

    SHA256

    3f52a7e18c301145759087bca0e25f84da1b3a8134a8520ea232fd50aa175291

    SHA512

    7193607ff258ea73f727c84d154fc428e8cd027ff45e4975568703e8a7d07e0816e8e43827db3151f8204c2d5b10ea63c81ae48e3156d959651456eff7c195db

  • C:\Temp\rolheauqnk.exe

    Filesize

    361KB

    MD5

    08b95a0045da6221786c4c6d157ac7ec

    SHA1

    5bb3b92a685990c0cb5db8287178b8c161a2e836

    SHA256

    dd433487287ffb70c51c24a09f0096490431e958a9f1c78ad58e45fe5c8c9a69

    SHA512

    aa77e41bb203014c07837d0f15b1a0cf8966ae51a0bb2a6b0f0f114aded243c14207464af475cb19b075e6ca10e1cb07b08d06512a14fdb3e3e13763526b3040

  • C:\temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    d0bc79e37348f260253b6d22bdcf7825

    SHA1

    9802ff19aa6196b8b2b7f2c33ce6d112c78c65b1

    SHA256

    810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344

    SHA512

    bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    d0bc79e37348f260253b6d22bdcf7825

    SHA1

    9802ff19aa6196b8b2b7f2c33ce6d112c78c65b1

    SHA256

    810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344

    SHA512

    bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    d0bc79e37348f260253b6d22bdcf7825

    SHA1

    9802ff19aa6196b8b2b7f2c33ce6d112c78c65b1

    SHA256

    810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344

    SHA512

    bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    d0bc79e37348f260253b6d22bdcf7825

    SHA1

    9802ff19aa6196b8b2b7f2c33ce6d112c78c65b1

    SHA256

    810c4dc8f34cc59229914f03b2cfa8f6fb0526ffef13ca776fba8f10d0d64344

    SHA512

    bc0415998241bc288738feff8437337119dbaeb5b5471ed0109a8c5d6e185a4fc66bf3dd9d2f6c8f9dd5fc6ac31f7de746b86808deeae2c8ad3634322fca8d29

  • \Temp\cxtpldrnjeathcyu.exe

    Filesize

    361KB

    MD5

    0e79161b4b04056c3669ae38c9ddf7c8

    SHA1

    d15c043eebc3c6b48804e7281035abe4746483fd

    SHA256

    3f52a7e18c301145759087bca0e25f84da1b3a8134a8520ea232fd50aa175291

    SHA512

    7193607ff258ea73f727c84d154fc428e8cd027ff45e4975568703e8a7d07e0816e8e43827db3151f8204c2d5b10ea63c81ae48e3156d959651456eff7c195db