Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe
Resource
win10v2004-20220812-en
General
-
Target
32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe
-
Size
311KB
-
MD5
1805da093d14dce4466aac6574252ee0
-
SHA1
e4e28ccef363ce2f0dd0e10896191f4c66c04cc1
-
SHA256
32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466
-
SHA512
c3013354131c9a5a56c77d260708dcd8cd5bb7062f7547078685a0743fd0febfe2a4b62fc96a36962a91c7667c9db1cf24baee60c19d86a3ab2a1adb30be4631
-
SSDEEP
6144:ff1eELPVMcyWzdiGTjj+5oUBl06CoYEcnOkwYKrivp6fyRU:ffDpyWzdTCouqbEBGvp8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1604 odalcu.exe -
Deletes itself 1 IoCs
pid Process 840 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\{91C05068-4FEF-AD4D-7F1F-8FEC7D0BACF1} = "C:\\Users\\Admin\\AppData\\Roaming\\Uszere\\odalcu.exe" odalcu.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\Currentversion\Run odalcu.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1488 set thread context of 840 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 28 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Privacy 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe 1604 odalcu.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1604 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 27 PID 1488 wrote to memory of 1604 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 27 PID 1488 wrote to memory of 1604 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 27 PID 1488 wrote to memory of 1604 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 27 PID 1604 wrote to memory of 1228 1604 odalcu.exe 12 PID 1604 wrote to memory of 1228 1604 odalcu.exe 12 PID 1604 wrote to memory of 1228 1604 odalcu.exe 12 PID 1604 wrote to memory of 1228 1604 odalcu.exe 12 PID 1604 wrote to memory of 1228 1604 odalcu.exe 12 PID 1604 wrote to memory of 1316 1604 odalcu.exe 11 PID 1604 wrote to memory of 1316 1604 odalcu.exe 11 PID 1604 wrote to memory of 1316 1604 odalcu.exe 11 PID 1604 wrote to memory of 1316 1604 odalcu.exe 11 PID 1604 wrote to memory of 1316 1604 odalcu.exe 11 PID 1604 wrote to memory of 1352 1604 odalcu.exe 10 PID 1604 wrote to memory of 1352 1604 odalcu.exe 10 PID 1604 wrote to memory of 1352 1604 odalcu.exe 10 PID 1604 wrote to memory of 1352 1604 odalcu.exe 10 PID 1604 wrote to memory of 1352 1604 odalcu.exe 10 PID 1604 wrote to memory of 1488 1604 odalcu.exe 26 PID 1604 wrote to memory of 1488 1604 odalcu.exe 26 PID 1604 wrote to memory of 1488 1604 odalcu.exe 26 PID 1604 wrote to memory of 1488 1604 odalcu.exe 26 PID 1604 wrote to memory of 1488 1604 odalcu.exe 26 PID 1488 wrote to memory of 840 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 28 PID 1488 wrote to memory of 840 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 28 PID 1488 wrote to memory of 840 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 28 PID 1488 wrote to memory of 840 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 28 PID 1488 wrote to memory of 840 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 28 PID 1488 wrote to memory of 840 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 28 PID 1488 wrote to memory of 840 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 28 PID 1488 wrote to memory of 840 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 28 PID 1488 wrote to memory of 840 1488 32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe 28
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe"C:\Users\Admin\AppData\Local\Temp\32d72efdd9e2788bea225e149c7fdbcfac07c63eaae6f330bacc2d858fcbe466.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Roaming\Uszere\odalcu.exe"C:\Users\Admin\AppData\Roaming\Uszere\odalcu.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp31b8fe91.bat"3⤵
- Deletes itself
PID:840
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1316
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1228
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD508188ed4384b3db671023753e96f60d6
SHA177b8fb26a4d89c8350ff6c0d1e4e025fcf40aeb4
SHA256862471906ab2fc091c5194a57ddb7a78dacd67f25e015051a121974b01110804
SHA5122cda4f334e1764303e786be51945f6ec74d9d4dc6d93f6aef922fe48b3afe02783d0dcddfda964516e5bab688096a5518855080a656a4765fe7e24838bfc3294
-
Filesize
311KB
MD558bfc421286907b0b2acb792fc49f2b4
SHA10e613297743144a08b533541f4362a1c78ffb06c
SHA256162109fced44052495be6180ca9ca6c10d3f1fc760dbe05e27d1e71f6a55faae
SHA512e1ef5e73515cf2c8c9f02a756fa2998128646e5b4144f31715c6c35aeb4fa5da7d5bcdf86c5df5bca85b14607ac26f25653d5c03beea37daaa54979e1f010c17
-
Filesize
311KB
MD558bfc421286907b0b2acb792fc49f2b4
SHA10e613297743144a08b533541f4362a1c78ffb06c
SHA256162109fced44052495be6180ca9ca6c10d3f1fc760dbe05e27d1e71f6a55faae
SHA512e1ef5e73515cf2c8c9f02a756fa2998128646e5b4144f31715c6c35aeb4fa5da7d5bcdf86c5df5bca85b14607ac26f25653d5c03beea37daaa54979e1f010c17
-
Filesize
311KB
MD558bfc421286907b0b2acb792fc49f2b4
SHA10e613297743144a08b533541f4362a1c78ffb06c
SHA256162109fced44052495be6180ca9ca6c10d3f1fc760dbe05e27d1e71f6a55faae
SHA512e1ef5e73515cf2c8c9f02a756fa2998128646e5b4144f31715c6c35aeb4fa5da7d5bcdf86c5df5bca85b14607ac26f25653d5c03beea37daaa54979e1f010c17