Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    36s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 15:49

General

  • Target

    c18087af5de586664422c8b1844dee8d49cc935b27078cbb632d724a4f46771e.exe

  • Size

    198KB

  • MD5

    7a62dd6af92d259fd11b681446b4ab1e

  • SHA1

    7280c669158baa18c1ff2996d3402ba9e9216f52

  • SHA256

    c18087af5de586664422c8b1844dee8d49cc935b27078cbb632d724a4f46771e

  • SHA512

    0a101f45370bc8142379d2e331db994f73a1b25524fa738ebe2c27820a2353723b666725322e704f7bde624559591dcccb6979a35c4f8e79999b11c17ebfecf9

  • SSDEEP

    3072:r7+mrh42ya4kcFoWZHlWzzXGOJlBpPlPlUHV2I+h+7dUchBpp:rZrh42xcTHlrMXRlPN+7dd

Malware Config

Signatures

  • Sets file execution options in registry 2 TTPs 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 41 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c18087af5de586664422c8b1844dee8d49cc935b27078cbb632d724a4f46771e.exe
    "C:\Users\Admin\AppData\Local\Temp\c18087af5de586664422c8b1844dee8d49cc935b27078cbb632d724a4f46771e.exe"
    1⤵
    • Sets file execution options in registry
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s C:\Windows\system32\dq41573.dll
      2⤵
      • Sets file execution options in registry
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Modifies registry class
      PID:1992

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\dq41573.dll

    Filesize

    192KB

    MD5

    3895ec96f2c08784c68ade6eb2aa701c

    SHA1

    1d35e2fac98b4e378b670feba13782be438cd7cb

    SHA256

    74163d48300f528eb5464813e81887eb5ee39cfb440f15b6df587cabeb55392c

    SHA512

    e652e017acedf4c96661af1ed1bb7c6a6ad0d582e02eecbdf27803023915959df0f81a0b39ca5cf8a37764913903ecaee62a44906513c20f879026a736434f54

  • \Windows\SysWOW64\dq41573.dll

    Filesize

    192KB

    MD5

    3895ec96f2c08784c68ade6eb2aa701c

    SHA1

    1d35e2fac98b4e378b670feba13782be438cd7cb

    SHA256

    74163d48300f528eb5464813e81887eb5ee39cfb440f15b6df587cabeb55392c

    SHA512

    e652e017acedf4c96661af1ed1bb7c6a6ad0d582e02eecbdf27803023915959df0f81a0b39ca5cf8a37764913903ecaee62a44906513c20f879026a736434f54

  • memory/1368-54-0x0000000076071000-0x0000000076073000-memory.dmp

    Filesize

    8KB