Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2022, 19:31

General

  • Target

    42463183ee6cb54f3892fe29c7dd44cf76748c3609c474f442ccd4b4aa610c75.exe

  • Size

    208KB

  • MD5

    0422556b674590940816f1f31b4c590c

  • SHA1

    07b9b67e4bdbf7de55bfc9374a863ec44ea93373

  • SHA256

    42463183ee6cb54f3892fe29c7dd44cf76748c3609c474f442ccd4b4aa610c75

  • SHA512

    04f7f20a6399f6aeb5266a7e4626869bb035460d61fd87c7b4f5ad33ba1d4142a180375368b77ae078aad3456bf99b2e301e4c9d4ecafdf7dbee7bf0b3ec70a9

  • SSDEEP

    1536:Vfuxw10lxJM5y8w5OZRVmgyDl+cWaxJcveQZNTRSb3EBAR1AlQPsxjheYhpXN5yh:f0OtF2Qo7VsJgisxlYegEX0ZZbW

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42463183ee6cb54f3892fe29c7dd44cf76748c3609c474f442ccd4b4aa610c75.exe
    "C:\Users\Admin\AppData\Local\Temp\42463183ee6cb54f3892fe29c7dd44cf76748c3609c474f442ccd4b4aa610c75.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Users\Admin\AppData\Local\Temp\42463183ee6cb54f3892fe29c7dd44cf76748c3609c474f442ccd4b4aa610c75.exe
      "C:\Users\Admin\AppData\Local\Temp\42463183ee6cb54f3892fe29c7dd44cf76748c3609c474f442ccd4b4aa610c75.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\YOPNV.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1072
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svhust" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe" /f
          4⤵
          • Adds Run key to start application
          PID:2028
      • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
        "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
          "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious use of FindShellTrayWindow
          PID:1764
        • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe
          "C:\Users\Admin\AppData\Roaming\svhust\svhust.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1892

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\YOPNV.bat

    Filesize

    141B

    MD5

    e83a2e0b3c1e03dfb96ffd9924117a45

    SHA1

    27a3e4ba115ba1bad0bf094f5b97e768d1ece33e

    SHA256

    655407d94fff9e707712a588d97a2017cc1c9d690a67c688ed0abcb79e452b13

    SHA512

    5f61686a3b7db3544d83a4f2ce1a75868c7dc266709f72a34eafecc3a26696a985b1912a559aed8f5a2cacbfe26be9beae2374340d1801bb18473de785557480

  • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe

    Filesize

    208KB

    MD5

    efe1fbead822e7726e907da6ca08d336

    SHA1

    0b17683f6a6eea7947920a2f4706b99a275b005d

    SHA256

    6f1a8cc34dfb8b41ec8d398ae556ae35a92fb80f5c4055df14cfa51a7cb70b9c

    SHA512

    203c86aeedac947650a1f3e81dc40a3d64d4377c944e8f6f9821640afdf04aca521c574366c05ccd9ea8beca7facafc14f86b6444aabbd42a5c06bf985754438

  • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe

    Filesize

    208KB

    MD5

    efe1fbead822e7726e907da6ca08d336

    SHA1

    0b17683f6a6eea7947920a2f4706b99a275b005d

    SHA256

    6f1a8cc34dfb8b41ec8d398ae556ae35a92fb80f5c4055df14cfa51a7cb70b9c

    SHA512

    203c86aeedac947650a1f3e81dc40a3d64d4377c944e8f6f9821640afdf04aca521c574366c05ccd9ea8beca7facafc14f86b6444aabbd42a5c06bf985754438

  • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe

    Filesize

    208KB

    MD5

    efe1fbead822e7726e907da6ca08d336

    SHA1

    0b17683f6a6eea7947920a2f4706b99a275b005d

    SHA256

    6f1a8cc34dfb8b41ec8d398ae556ae35a92fb80f5c4055df14cfa51a7cb70b9c

    SHA512

    203c86aeedac947650a1f3e81dc40a3d64d4377c944e8f6f9821640afdf04aca521c574366c05ccd9ea8beca7facafc14f86b6444aabbd42a5c06bf985754438

  • C:\Users\Admin\AppData\Roaming\svhust\svhust.exe

    Filesize

    208KB

    MD5

    efe1fbead822e7726e907da6ca08d336

    SHA1

    0b17683f6a6eea7947920a2f4706b99a275b005d

    SHA256

    6f1a8cc34dfb8b41ec8d398ae556ae35a92fb80f5c4055df14cfa51a7cb70b9c

    SHA512

    203c86aeedac947650a1f3e81dc40a3d64d4377c944e8f6f9821640afdf04aca521c574366c05ccd9ea8beca7facafc14f86b6444aabbd42a5c06bf985754438

  • \Users\Admin\AppData\Roaming\svhust\svhust.exe

    Filesize

    208KB

    MD5

    efe1fbead822e7726e907da6ca08d336

    SHA1

    0b17683f6a6eea7947920a2f4706b99a275b005d

    SHA256

    6f1a8cc34dfb8b41ec8d398ae556ae35a92fb80f5c4055df14cfa51a7cb70b9c

    SHA512

    203c86aeedac947650a1f3e81dc40a3d64d4377c944e8f6f9821640afdf04aca521c574366c05ccd9ea8beca7facafc14f86b6444aabbd42a5c06bf985754438

  • \Users\Admin\AppData\Roaming\svhust\svhust.exe

    Filesize

    208KB

    MD5

    efe1fbead822e7726e907da6ca08d336

    SHA1

    0b17683f6a6eea7947920a2f4706b99a275b005d

    SHA256

    6f1a8cc34dfb8b41ec8d398ae556ae35a92fb80f5c4055df14cfa51a7cb70b9c

    SHA512

    203c86aeedac947650a1f3e81dc40a3d64d4377c944e8f6f9821640afdf04aca521c574366c05ccd9ea8beca7facafc14f86b6444aabbd42a5c06bf985754438

  • \Users\Admin\AppData\Roaming\svhust\svhust.exe

    Filesize

    208KB

    MD5

    efe1fbead822e7726e907da6ca08d336

    SHA1

    0b17683f6a6eea7947920a2f4706b99a275b005d

    SHA256

    6f1a8cc34dfb8b41ec8d398ae556ae35a92fb80f5c4055df14cfa51a7cb70b9c

    SHA512

    203c86aeedac947650a1f3e81dc40a3d64d4377c944e8f6f9821640afdf04aca521c574366c05ccd9ea8beca7facafc14f86b6444aabbd42a5c06bf985754438

  • \Users\Admin\AppData\Roaming\svhust\svhust.exe

    Filesize

    208KB

    MD5

    efe1fbead822e7726e907da6ca08d336

    SHA1

    0b17683f6a6eea7947920a2f4706b99a275b005d

    SHA256

    6f1a8cc34dfb8b41ec8d398ae556ae35a92fb80f5c4055df14cfa51a7cb70b9c

    SHA512

    203c86aeedac947650a1f3e81dc40a3d64d4377c944e8f6f9821640afdf04aca521c574366c05ccd9ea8beca7facafc14f86b6444aabbd42a5c06bf985754438

  • memory/736-56-0x00000000005DD000-0x00000000005F3000-memory.dmp

    Filesize

    88KB

  • memory/1740-82-0x000000000051D000-0x0000000000532000-memory.dmp

    Filesize

    84KB

  • memory/1764-107-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/1764-106-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/1764-114-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/1764-92-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/1764-94-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/1764-111-0x00000000744E1000-0x00000000744E3000-memory.dmp

    Filesize

    8KB

  • memory/1764-98-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/1764-99-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/1764-110-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/1880-65-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1880-59-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1880-66-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1880-62-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1880-108-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1880-61-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1880-70-0x0000000076201000-0x0000000076203000-memory.dmp

    Filesize

    8KB

  • memory/1880-58-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1880-69-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1892-109-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1892-113-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB