Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    74s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 00:09

General

  • Target

    6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe

  • Size

    179KB

  • MD5

    77f21ab212c513d9f6209c50ecc17d90

  • SHA1

    0a2e6120143a2a65ea1657ae5a73154214190f32

  • SHA256

    6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b

  • SHA512

    f1cd4dd47789d838a1d31ca86faa136023b38feb3507ba2c789c68e58381a5f0fac4460fe2db1dd5396d22d7e7382c82990045da95dfc7eab0b0546d0737aa7e

  • SSDEEP

    3072:akAwOzhjdRmSZiAqFbrnp+KsYGngDrSsi5LNURwM/0j4IJqmxOilu+jGvCsfe4mf:+w8h/7PCkKsYGgDrS1L2wDMIgmxBuKM6

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 53 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe
    "C:\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe
      C:\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1012
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1840 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1160

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1B777E71-490A-11ED-B25A-FE72C9E2D9C9}.dat

    Filesize

    3KB

    MD5

    f14cd19368435f3843ea1e4cd4e29688

    SHA1

    44fdfc098efa148a126e7c0fb661d5e8a18d884c

    SHA256

    1e68b06ce6596dbff356494ddc27486b92724ffc7721d073c2843284e838afd1

    SHA512

    ad540341e7d4a9592b238bb4375526c8d624119bfdd583bf02f408fe694dd0cecd99b49249b1c663a36d91f4704a61e3ce25e2876f7b7c7c823300e5e037043c

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1B792C21-490A-11ED-B25A-FE72C9E2D9C9}.dat

    Filesize

    3KB

    MD5

    ef7110273a00254693b558f9d628226e

    SHA1

    b57c91c9d3e98a3476318856552da10c96b5ff7b

    SHA256

    b85e596df97ff390b0e9b78169ab8ae10705b4530ce572a06eff8b16e59903a0

    SHA512

    83c7af91873088f21689a0d7d1f34629d8d1787bb7e41c5148a2823cc5919ec2a4a348d0efc47c1eee7c16597a9a9ae2b6b6ad37a2728aa6c8ab7cf245afb46e

  • C:\Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe

    Filesize

    88KB

    MD5

    a61ea5f2325332c52bff5bce3d161336

    SHA1

    3a883b8241f5f2efaa76367240db800d78a0209c

    SHA256

    e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b

    SHA512

    fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\G67H9LSB.txt

    Filesize

    603B

    MD5

    5c4d0afa591636d23d877ed42e51b973

    SHA1

    b92ab0ba3a742128c07a18643c023290be98e752

    SHA256

    8b9eda7da76ba519786eeab2e71b03517ebc0b2e61a5435ece3699a421241853

    SHA512

    5ed33283724f6c1e15c4160252a9d136fdbbd3c17190cea8d8445b1faafd9aca4486d02b21ff14cebfae5ee381a4273800e4544a76a2ee5473b157051e5f4461

  • \Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe

    Filesize

    88KB

    MD5

    a61ea5f2325332c52bff5bce3d161336

    SHA1

    3a883b8241f5f2efaa76367240db800d78a0209c

    SHA256

    e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b

    SHA512

    fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5

  • \Users\Admin\AppData\Local\Temp\6b31407854cdf85811a775c88d01fe778f103336bcd9fd4b7fa6dcc98ab9440bmgr.exe

    Filesize

    88KB

    MD5

    a61ea5f2325332c52bff5bce3d161336

    SHA1

    3a883b8241f5f2efaa76367240db800d78a0209c

    SHA256

    e6f8a54ed663061527ab46b8e8efc2a0f3c99ae77829c0be0e50eb5b1b48415b

    SHA512

    fae031e0e7dcd719240bfe94a3f78d1aac73060324d5b65e0cbe564ce6d6781aaa5e930f0729293e3b502b7d07f53f3a72fb2048d44d93d36851aab8330479e5

  • memory/1044-60-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/1044-63-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/1428-66-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB