Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2022, 22:46

General

  • Target

    513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe

  • Size

    301KB

  • MD5

    77d0ce0683aa2f27c161f1c1c3ac87f4

  • SHA1

    f9c6f8db507e5ae9e7ee3bce6682d2310b31b7da

  • SHA256

    513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4

  • SHA512

    1d3267aaa1e84038c2b833dec662aaac272709985bf0b120dd66606eb299bba9ea95940d6b51eedbf3f14f011ce6f6c69fcc37fd3efc80f1ecd36efa5fb9401c

  • SSDEEP

    6144:NCjVktZuPRDf+cxRPxEYhBHStiVuU9r8wYbF0wp3kskcRAdAVx64eI7oFcnzd8PA:NCjutZu5Dm27HStVMr8wYbF0wp3kskcX

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 46 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe
    "C:\Users\Admin\AppData\Local\Temp\513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Windows\ZAYUOZBIDUJF.dll"
      2⤵
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:1696
    • C:\Users\Admin\AppData\Local\Temp\SteepleContortion.exe
      "C:\Users\Admin\AppData\Local\Temp\SteepleContortion.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      PID:1360
    • C:\Users\Admin\AppData\Local\Temp\SteepleContortion.exe
      C:\Users\Admin\AppData\Local\Temp\SteepleContortion.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      PID:608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SteepleContortion.exe

    Filesize

    28KB

    MD5

    6697555ead62e6b9fb71a0ffb6d62992

    SHA1

    55b57b52fe0d4af8716db57a98ab011b1dbe4181

    SHA256

    683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6

    SHA512

    36b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8

  • C:\Users\Admin\AppData\Local\Temp\SteepleContortion.exe

    Filesize

    28KB

    MD5

    6697555ead62e6b9fb71a0ffb6d62992

    SHA1

    55b57b52fe0d4af8716db57a98ab011b1dbe4181

    SHA256

    683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6

    SHA512

    36b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8

  • C:\Windows\ZAYUOZBIDUJF.dll

    Filesize

    333KB

    MD5

    b97630aa0bfe1420c162a253610d170a

    SHA1

    16c9ea06288ab5948612d2dcb28be2df719dda35

    SHA256

    d9ecd3a1bcabe58164820a4dc28277652ac2f5f6efeff6ab46cf8d3b88a37b65

    SHA512

    6dd5296f88d6fadb59b1722a92e716a4135bb6f37b1b9ac31b884ff1f9d8c4ebc8d96914e68f67074254d24fc8a4cbaaf1ce5fb9980875d77a8173da49189ec2

  • \Users\Admin\AppData\Local\Temp\SteepleContortion.exe

    Filesize

    28KB

    MD5

    6697555ead62e6b9fb71a0ffb6d62992

    SHA1

    55b57b52fe0d4af8716db57a98ab011b1dbe4181

    SHA256

    683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6

    SHA512

    36b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8

  • \Users\Admin\AppData\Local\Temp\SteepleContortion.exe

    Filesize

    28KB

    MD5

    6697555ead62e6b9fb71a0ffb6d62992

    SHA1

    55b57b52fe0d4af8716db57a98ab011b1dbe4181

    SHA256

    683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6

    SHA512

    36b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8

  • \Users\Admin\AppData\Local\Temp\SteepleContortion.exe

    Filesize

    28KB

    MD5

    6697555ead62e6b9fb71a0ffb6d62992

    SHA1

    55b57b52fe0d4af8716db57a98ab011b1dbe4181

    SHA256

    683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6

    SHA512

    36b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8

  • \Users\Admin\AppData\Local\Temp\SteepleContortion.exe

    Filesize

    28KB

    MD5

    6697555ead62e6b9fb71a0ffb6d62992

    SHA1

    55b57b52fe0d4af8716db57a98ab011b1dbe4181

    SHA256

    683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6

    SHA512

    36b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8

  • memory/1960-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

    Filesize

    8KB