Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 03:36

General

  • Target

    53a61cf4b6f0ca6073e2a02490d2bf005abc5a5b10866f9b901c3cd46b397a05.exe

  • Size

    361KB

  • MD5

    31dc9f91264d3e40dc2ea7d6943b0a7b

  • SHA1

    28e4fec8a6077256c418e4cc866a95c49b7d2dcc

  • SHA256

    53a61cf4b6f0ca6073e2a02490d2bf005abc5a5b10866f9b901c3cd46b397a05

  • SHA512

    2f94af8a8c1d64589cfae59a60e978e6d43ec65ee76d8a1f2d31eb200137e59fbc011b2ded5302cc0aa6e820a43c8b0461808f355ee8af3a19c826bc6ac0f209

  • SSDEEP

    6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\53a61cf4b6f0ca6073e2a02490d2bf005abc5a5b10866f9b901c3cd46b397a05.exe
    "C:\Users\Admin\AppData\Local\Temp\53a61cf4b6f0ca6073e2a02490d2bf005abc5a5b10866f9b901c3cd46b397a05.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Temp\fazmljfdypojhgbs.exe
      C:\Temp\fazmljfdypojhgbs.exe run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1000
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\eaawtpmliw.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1540
        • C:\Temp\eaawtpmliw.exe
          C:\Temp\eaawtpmliw.exe ups_run
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2016
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:580
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1504
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1176

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1e9659264af81451743f23b613aca01d

    SHA1

    045fd59232af04892f105ffe7e0f3ed910dc930d

    SHA256

    607c39cf223aebb5b34d1ebefc87e06315e2cf2d79ffe3b2867703626ee84f2e

    SHA512

    39c241db917d64ecec18801cc5e6a62c28250f664571bcff490d25022736e2e169330e1cf5dc2308c67655f7de82a7b520bf7fec183bc3d6c2b9d707d42d84de

  • C:\Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1e9659264af81451743f23b613aca01d

    SHA1

    045fd59232af04892f105ffe7e0f3ed910dc930d

    SHA256

    607c39cf223aebb5b34d1ebefc87e06315e2cf2d79ffe3b2867703626ee84f2e

    SHA512

    39c241db917d64ecec18801cc5e6a62c28250f664571bcff490d25022736e2e169330e1cf5dc2308c67655f7de82a7b520bf7fec183bc3d6c2b9d707d42d84de

  • C:\Temp\eaawtpmliw.exe

    Filesize

    361KB

    MD5

    ca182a86fde2003f02612fcee8f18d5b

    SHA1

    604e4579d9aef80f991c398743a673b5abcc4fa9

    SHA256

    cccb6a2d126a4303502f436a7ccefd570e394ea203fafcf73d957f9d229cf7af

    SHA512

    6a0673b3a18cde5279f01ca58ccdda65056b8a575dcf49773b2e4d81af3c7386ae8aa192dbbcc88045c80e54ebea71fea486a9ea89038e13b819262be65e48a6

  • C:\Temp\fazmljfdypojhgbs.exe

    Filesize

    361KB

    MD5

    b47faee155ee9e567a3482883cab2d58

    SHA1

    030633256424cc87c9237de184692522a5d40eda

    SHA256

    e3c300c9a7af351ed0eb35afab114733cd7b5ad8c0581c4ac15024d6f7db1f30

    SHA512

    dc2d6a40d107e0cd4fdde6fdd73a3f49f8defccec1eabf93c5f75ae411775c07d1982bb48061d8f4649714db0420372d201c5191f4782b8b09914f13cb7729c8

  • C:\Temp\fazmljfdypojhgbs.exe

    Filesize

    361KB

    MD5

    b47faee155ee9e567a3482883cab2d58

    SHA1

    030633256424cc87c9237de184692522a5d40eda

    SHA256

    e3c300c9a7af351ed0eb35afab114733cd7b5ad8c0581c4ac15024d6f7db1f30

    SHA512

    dc2d6a40d107e0cd4fdde6fdd73a3f49f8defccec1eabf93c5f75ae411775c07d1982bb48061d8f4649714db0420372d201c5191f4782b8b09914f13cb7729c8

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2SDDPA4C.txt

    Filesize

    603B

    MD5

    29575c505340d813a556b64acfd8557a

    SHA1

    feaaeebab93c31063d9437c6cd6c6d2a7b489d72

    SHA256

    6861c03624f3237132d5247a77bd0695888deb42202892e59f761cd3355f45a9

    SHA512

    06c92e98c0cab2d9017c292819ce8aa3871d903f3bfaa16174ae77b12072998df62a7ad0f6030be1b88ae647737b949ecf1b9df7c8933e3ccb63b7cebed71861

  • C:\temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1e9659264af81451743f23b613aca01d

    SHA1

    045fd59232af04892f105ffe7e0f3ed910dc930d

    SHA256

    607c39cf223aebb5b34d1ebefc87e06315e2cf2d79ffe3b2867703626ee84f2e

    SHA512

    39c241db917d64ecec18801cc5e6a62c28250f664571bcff490d25022736e2e169330e1cf5dc2308c67655f7de82a7b520bf7fec183bc3d6c2b9d707d42d84de

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1e9659264af81451743f23b613aca01d

    SHA1

    045fd59232af04892f105ffe7e0f3ed910dc930d

    SHA256

    607c39cf223aebb5b34d1ebefc87e06315e2cf2d79ffe3b2867703626ee84f2e

    SHA512

    39c241db917d64ecec18801cc5e6a62c28250f664571bcff490d25022736e2e169330e1cf5dc2308c67655f7de82a7b520bf7fec183bc3d6c2b9d707d42d84de

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1e9659264af81451743f23b613aca01d

    SHA1

    045fd59232af04892f105ffe7e0f3ed910dc930d

    SHA256

    607c39cf223aebb5b34d1ebefc87e06315e2cf2d79ffe3b2867703626ee84f2e

    SHA512

    39c241db917d64ecec18801cc5e6a62c28250f664571bcff490d25022736e2e169330e1cf5dc2308c67655f7de82a7b520bf7fec183bc3d6c2b9d707d42d84de

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1e9659264af81451743f23b613aca01d

    SHA1

    045fd59232af04892f105ffe7e0f3ed910dc930d

    SHA256

    607c39cf223aebb5b34d1ebefc87e06315e2cf2d79ffe3b2867703626ee84f2e

    SHA512

    39c241db917d64ecec18801cc5e6a62c28250f664571bcff490d25022736e2e169330e1cf5dc2308c67655f7de82a7b520bf7fec183bc3d6c2b9d707d42d84de

  • \Temp\fazmljfdypojhgbs.exe

    Filesize

    361KB

    MD5

    b47faee155ee9e567a3482883cab2d58

    SHA1

    030633256424cc87c9237de184692522a5d40eda

    SHA256

    e3c300c9a7af351ed0eb35afab114733cd7b5ad8c0581c4ac15024d6f7db1f30

    SHA512

    dc2d6a40d107e0cd4fdde6fdd73a3f49f8defccec1eabf93c5f75ae411775c07d1982bb48061d8f4649714db0420372d201c5191f4782b8b09914f13cb7729c8