Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    26s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2022, 09:20

General

  • Target

    705a8574cd36f8c54e92c5e30b8faf3df2fc4c51bbc365c4a86a61b3b41bf44d.exe

  • Size

    313KB

  • MD5

    62265ca50550d481cdd9ac3d6076e230

  • SHA1

    ba92a49252ff28ebe8d878461f37bcbbbb19b003

  • SHA256

    705a8574cd36f8c54e92c5e30b8faf3df2fc4c51bbc365c4a86a61b3b41bf44d

  • SHA512

    8f8c11cb6583d17dc4a74fbe2ea1bc0d61b79ba8f7c3713209b099f75080456aaa60e582d0d90da45826fc7bdfae46b1cae6afe30c40acb3957229875c15e5a2

  • SSDEEP

    6144:91OgDPdkBAFZWjadD4sLtOgLYD9bEmUJ4RwdPjTe:91OgLda0OlD9An4R3

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 14 IoCs
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\705a8574cd36f8c54e92c5e30b8faf3df2fc4c51bbc365c4a86a61b3b41bf44d.exe
    "C:\Users\Admin\AppData\Local\Temp\705a8574cd36f8c54e92c5e30b8faf3df2fc4c51bbc365c4a86a61b3b41bf44d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\setup.exe
      .\setup.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • System policy modification
      PID:2036

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\[email protected]\chrome.manifest

    Filesize

    114B

    MD5

    a257253d35f1ca127ed0facdac4b7fce

    SHA1

    0de4657c4792658aa537b480d12950b18add06ac

    SHA256

    008689ba860d92465738e5d5185a3d91ac2ff642778ac545aa2bf7dcb97fe710

    SHA512

    d50890d866368037dca7aad2906ca715162dfc557a5cfbf975a8f3a247dd68697d45c1866465f25e1ddbdf41b3c8162a0ea20afe1e7ca65a5bcbac738cf5b3b2

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\[email protected]\content\indexeddb.js

    Filesize

    1KB

    MD5

    250f175c675745afed4439303cebd00c

    SHA1

    1eb0c32b1e72635a3934992047f0b1457a89ce90

    SHA256

    ea63a344f4bfb06dbf6360757d90667565000e2d315e67621f7d9a39fb21ac11

    SHA512

    ae4333c3797c4bcc32df7237da41fa5334a2c3b41b4f1f4e7674e6791053f6e11d8408d8d516bbcc50f0da7a6073202079622e36f6baf4af42148b8b40ad9aa2

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\[email protected]\content\jquery.js

    Filesize

    91KB

    MD5

    4bab8348a52d17428f684ad1ec3a427e

    SHA1

    56c912a8c8561070aee7b9808c5f3b2abec40063

    SHA256

    3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23

    SHA512

    a693069c66d8316d73a3c01ed9e6a4553c9b92d98b294f0e170cc9f9f5502c814255f5f92b93aeb07e0d6fe4613f9a1d511e1bfd965634f04e6cf18f191a7480

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\[email protected]\content\jsext.js

    Filesize

    6KB

    MD5

    de7ef993146144b7f5c4e4a4c1a024ed

    SHA1

    65dde5797782e7de1aab07eb773d9e6f352596a6

    SHA256

    9cab89124299fbdf00fef4d8d97412c3b975ab6c34762aa38e18cc02f198d8f6

    SHA512

    418d2c082fe1dd9868fd5edc7fcc4c4001d0595a7a447cab4cca14001575109f0401c85878cc967951f682d7036f22222c03ae8aa62663b79e1e52fd70ed62f1

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\[email protected]\content\lsdb.js

    Filesize

    1KB

    MD5

    db91bd3d79854eabb4ff20e632f449aa

    SHA1

    cdfeab3a19033d6b91b0918c805f1a34db7b40ed

    SHA256

    78198fb38d819c137784635cba8e5203bdeb71e10d7d6ea32f6635d5ea1b0542

    SHA512

    9dcac9e42a818831ddb7963009f54f94ecddf0f238ef36112659fb674f9e025326896376899d34eb5c436b729d7c4f7deb713cfa5407a6132a8fdfd801df84b2

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\[email protected]\content\prfdb.js

    Filesize

    1KB

    MD5

    25397348c9297ae18ecb13e8e451064d

    SHA1

    3615d59e41a4199122957ac49d80ab5558abf123

    SHA256

    d32a12dd3033a0a7b5ddeb036c92d447851e6ea7923d2966d15ad2dc3bc0282c

    SHA512

    74052c0ba0004531d9d9bdfe40c872532c2b4bde4a17f1c6ee47a90b7fc0c9ffa60a3c5cc2a96dba150e06ea558f2950f0613496361ddb6e68ae4fc0ef37ef53

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\[email protected]\content\sqlite.js

    Filesize

    1KB

    MD5

    a6a8cd82469030e4b17607b2811c1103

    SHA1

    35d4a77d2fc6cc3317b6cf13a609fa27df182a64

    SHA256

    8d9d113671c8436af0fa4ddd6f267c104015a1486df59cb24f888ec691715b66

    SHA512

    9cf2dd3a97be3ca5921a5c75935daab3a452cd68e3d1fe548cd49d2488a00c84f6c8cf4d29b897c2c03f49bd150fd80dad3480afbd419f56a2a754e68e1ad042

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\[email protected]\content\wx.xul

    Filesize

    228B

    MD5

    6dd4189aa07039ad0e036af25d90e602

    SHA1

    d0e45ac8c86c6026adc49d381e4ffd6bfcd6244d

    SHA256

    456f681d8fac416e1cf712d8262588fe635b209ee15487978f0d52906c9f6e82

    SHA512

    33bfc1450335dcbef8508838197bae67a6d7fc53331c2b7625422441256881c6b8423231d78abe256c59eb1ea9b9474e2f7c0c7ac315f618ccb0597beee1f268

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\[email protected]\install.rdf

    Filesize

    677B

    MD5

    ff81b3b63d92c7f2023d2cbd8a75bc01

    SHA1

    57445b28dfe29ce2a17a1cd85547540791387970

    SHA256

    a83778ba46f04b059e4afa20f9cb32b443cb5a1eaf65047792fbca42ba23d4b6

    SHA512

    48efd0214ce817c3c35600a01fa7fe808f304f76b356973d3279d4ed073d764ebb9a7ea944fd9231f0a5af6155242d9b64f37009e947e0c7754c3224d6a3f99e

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\background.html

    Filesize

    4KB

    MD5

    ca4bf9ddd74baf9b37f940f041248de9

    SHA1

    0a43b076347537dd7dddf3ea6b6a53737bb6dc96

    SHA256

    c73d40a24389f009b254c4493e6baa7fe4cd13fec6a50e3d837de4b5a2a15e76

    SHA512

    1b01a2478cc685f523867648864a07c8cae2dab69378f43ad9852869f19f2647b0ddbc6b221ff654fe2735c8e19e41c358ae32d1b80fe37bbdbbbbf014b5a9ae

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\bhoclass.dll

    Filesize

    137KB

    MD5

    ac13c733379328f86568f6e514c2f7f8

    SHA1

    338901240fedcef4e3892fd4c723c89154f4de05

    SHA256

    7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562

    SHA512

    35f69a82694a2ea4268a3dde7940af6bd1c87a32d93a72723464f90e4e818805be9e80872469d1cc29150a9aac872fc78613a584baa1327dfa8478c2de5672c4

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\content.js

    Filesize

    388B

    MD5

    8f3b7eeb98857aae149eb806d50a5c28

    SHA1

    8d64596c0cb34074ca00639bb4040d0d211acc4d

    SHA256

    d384192bee77def994ff93ce3a633b218b7435a0a7938ddf897dfcf1d5711f36

    SHA512

    3e67ef5608697239974b9cf960696ac77055aaa43e966e97ad5abca711a0041abefef779075868d82c8cc4c90c364590913253aecab5d0892d52d63fd52fb4e4

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\jbdgkdkgcjhngdajfdfkgjkjddgbmfpl.crx

    Filesize

    37KB

    MD5

    0caadb12d3b942cc202eed3513061d62

    SHA1

    1d995df5a5214ba8972128357a4f866c694022a3

    SHA256

    0b0b9e29bf043f27beb9e002d0a8394fec1e245221e48794b895e393478c1d3f

    SHA512

    8f9562aeaa0196d8e48681b5703cb1dd7add1544cff7361598b8088cc4b2ec37aec3388cf88ad081c0c39ac7df1c51d9e8b17faabac11cd1a4358db046d536e0

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\settings.ini

    Filesize

    610B

    MD5

    55a2c73386f10e1e0e69fac70d633633

    SHA1

    0a796c776e72443d3283101961b9584b9401bb9a

    SHA256

    88447b7bdfa74d66c9309de9f46f39a3494a7b8a2c3839b4fc3560879116be0f

    SHA512

    23244011a119ad074ff8d85356319c99cc9f3c5f33e640a765e423d87b1eb586eef70551d5c99cc8a9f32e49012fc6ea14b1010bd31822aa5dfa7505194ab24d

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\setup.exe

    Filesize

    61KB

    MD5

    201d2311011ffdf6c762fd46cdeb52ab

    SHA1

    65c474ca42a337745e288be0e21f43ceaafd5efe

    SHA256

    15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa

    SHA512

    235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b

  • C:\Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\setup.exe

    Filesize

    61KB

    MD5

    201d2311011ffdf6c762fd46cdeb52ab

    SHA1

    65c474ca42a337745e288be0e21f43ceaafd5efe

    SHA256

    15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa

    SHA512

    235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b

  • \ProgramData\ADDICT-THING\bhoclass.dll

    Filesize

    137KB

    MD5

    ac13c733379328f86568f6e514c2f7f8

    SHA1

    338901240fedcef4e3892fd4c723c89154f4de05

    SHA256

    7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562

    SHA512

    35f69a82694a2ea4268a3dde7940af6bd1c87a32d93a72723464f90e4e818805be9e80872469d1cc29150a9aac872fc78613a584baa1327dfa8478c2de5672c4

  • \ProgramData\ADDICT-THING\uninstall.exe

    Filesize

    46KB

    MD5

    2628f4240552cc3b2ba04ee51078ae0c

    SHA1

    5b0cca662149240d1fd4354beac1338e97e334ea

    SHA256

    03c965d0bd9827a978ef4080139533573aa800c9803599c0ce91da48506ad8f6

    SHA512

    6ecfcc97126373e82f1edab47020979d7706fc2be39ca792e8f30595133cd762cd4a65a246bee9180713e40e61efa373ecfb5eb72501ee18b38f13e32e61793b

  • \Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\setup.exe

    Filesize

    61KB

    MD5

    201d2311011ffdf6c762fd46cdeb52ab

    SHA1

    65c474ca42a337745e288be0e21f43ceaafd5efe

    SHA256

    15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa

    SHA512

    235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b

  • \Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\setup.exe

    Filesize

    61KB

    MD5

    201d2311011ffdf6c762fd46cdeb52ab

    SHA1

    65c474ca42a337745e288be0e21f43ceaafd5efe

    SHA256

    15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa

    SHA512

    235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b

  • \Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\setup.exe

    Filesize

    61KB

    MD5

    201d2311011ffdf6c762fd46cdeb52ab

    SHA1

    65c474ca42a337745e288be0e21f43ceaafd5efe

    SHA256

    15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa

    SHA512

    235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b

  • \Users\Admin\AppData\Local\Temp\7zSB7CC.tmp\setup.exe

    Filesize

    61KB

    MD5

    201d2311011ffdf6c762fd46cdeb52ab

    SHA1

    65c474ca42a337745e288be0e21f43ceaafd5efe

    SHA256

    15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa

    SHA512

    235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b

  • memory/1016-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

    Filesize

    8KB