Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    106s
  • max time network
    97s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 20:00

General

  • Target

    80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe

  • Size

    178KB

  • MD5

    70d2c5786b535e8f8487236db8526160

  • SHA1

    03d13a48f963945378c63bc38865f23617ed6ef6

  • SHA256

    80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992

  • SHA512

    17f68436e0c800ef6c38a98a5d47959aba7285ed45f5d568f79de5c2e767f2ee845bba852a8f064770df4375ef34b9946ba95749e8f148e395d61a022c8e4cf1

  • SSDEEP

    3072:akAwOzhjdRmSZiAqFbrnp+KsYGnggRqM86sUd8cKgev3Tno3LFkZWmv:+w8h/7PCkKsYGggB8mFrC3Lo3Ix

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe
    "C:\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe
      C:\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1292
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
        PID:2008

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe

      Filesize

      88KB

      MD5

      a61ea5f2325332c52bff5bce3d161336

      SHA1

      3a883b8241f5f2efaa76367240db800d78a0209c

      SHA256

      e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b

      SHA512

      fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SO0YFADH.txt

      Filesize

      597B

      MD5

      f5ae60d17543eea584ac884df5ba6950

      SHA1

      8c89a4b3f5db38095f32578d0e11108c233b2a51

      SHA256

      2bcf4e7ad2dbb74a2c236da907e231f505e5937d8ed663718a43c739b491e310

      SHA512

      62b5ab99c1e62b1a821e2814fb7b1f77ce560e50fd5fa99493de2e1c72523c3395a64cbc003a577fec267c3a45c01a7fdaa31c217cb43dfb6cd3777b31560891

    • \Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe

      Filesize

      88KB

      MD5

      a61ea5f2325332c52bff5bce3d161336

      SHA1

      3a883b8241f5f2efaa76367240db800d78a0209c

      SHA256

      e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b

      SHA512

      fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5

    • \Users\Admin\AppData\Local\Temp\80752f30ed3b42dbb004700e1ee670a50eebf2f9ad477fac333eea20923a6992mgr.exe

      Filesize

      88KB

      MD5

      a61ea5f2325332c52bff5bce3d161336

      SHA1

      3a883b8241f5f2efaa76367240db800d78a0209c

      SHA256

      e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b

      SHA512

      fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5

    • memory/536-64-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/536-62-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/768-66-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB