Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 04:35

General

  • Target

    73bf5be5536bd29c3724da5c6424fcee62eea420edb29762d0a99125f7511e46.exe

  • Size

    110KB

  • MD5

    877996da419cb48838d9769b24f6016c

  • SHA1

    1bd1a5ef7668b1a26eaa0c96c3ad7140428b9597

  • SHA256

    73bf5be5536bd29c3724da5c6424fcee62eea420edb29762d0a99125f7511e46

  • SHA512

    d4752f4e250f7ffae3fcd77e6cfadcd5b5360f1e02618cb285b6d73fef8c580911b211fd09b33b0da5141d3d1c8f3d7923163b68955679cebfacbdb521b838d3

  • SSDEEP

    3072:dUdvtJxKyKWGK3WtrHu6asw3rWe2LLcp/:dUdpzG2SrHxal3Ser

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\73bf5be5536bd29c3724da5c6424fcee62eea420edb29762d0a99125f7511e46.exe
    "C:\Users\Admin\AppData\Local\Temp\73bf5be5536bd29c3724da5c6424fcee62eea420edb29762d0a99125f7511e46.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1872
    • C:\Users\Admin\AppData\Roaming\Sunjava\SunJava.exe
      C:\Users\Admin\AppData\Roaming\Sunjava\SunJava.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Windows\SysWOW64\makecab.exe
        makecab "C:\Users\Admin\AppData\Roaming\signons.sqlite" "C:\Users\Admin\AppData\Roaming\sig.cab"
        3⤵
          PID:536
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c "dir C:\ /a"
          3⤵
            PID:836
          • C:\Windows\SysWOW64\regedit.exe
            regedit /e "C:\Users\Admin\AppData\Local\Temp\ORXGKKZC___Admin__Screen__10-21-06IE.reg" "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2\"
            3⤵
            • Runs .reg file with regedit
            PID:1164
        • C:\Windows\SysWOW64\explorer.exe
          explorer C:\Users\Admin\AppData\Local\Temp\73bf5be5536bd29c3724da5c6424fcee62eea420edb29762d0a99125f7511e46.jpg
          2⤵
            PID:1128
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
          1⤵
            PID:800
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0xc4
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:576

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\ORXGKK~1.REG

            Filesize

            11KB

            MD5

            5a74bbac69b55832f17c399fc47292be

            SHA1

            d920e4576b31a331f4cbe33685a43bc29493b973

            SHA256

            a6298d599f2968a8388e10fafbc7f4a2a2b227e98001bcd96c038284daff7534

            SHA512

            4a33be1bbee300f86bae0292cf6ebd2383228a94708049b5668d9e47f4f8854571ed53764e27b80f0c7bcdcd357eded609dd58e65f74b60aa44907ed2501be55

          • C:\Users\Admin\AppData\Roaming\SunJava\SunJava.exe

            Filesize

            110KB

            MD5

            877996da419cb48838d9769b24f6016c

            SHA1

            1bd1a5ef7668b1a26eaa0c96c3ad7140428b9597

            SHA256

            73bf5be5536bd29c3724da5c6424fcee62eea420edb29762d0a99125f7511e46

            SHA512

            d4752f4e250f7ffae3fcd77e6cfadcd5b5360f1e02618cb285b6d73fef8c580911b211fd09b33b0da5141d3d1c8f3d7923163b68955679cebfacbdb521b838d3

          • C:\Users\Admin\AppData\Roaming\Sunjava\SunJava.exe

            Filesize

            110KB

            MD5

            877996da419cb48838d9769b24f6016c

            SHA1

            1bd1a5ef7668b1a26eaa0c96c3ad7140428b9597

            SHA256

            73bf5be5536bd29c3724da5c6424fcee62eea420edb29762d0a99125f7511e46

            SHA512

            d4752f4e250f7ffae3fcd77e6cfadcd5b5360f1e02618cb285b6d73fef8c580911b211fd09b33b0da5141d3d1c8f3d7923163b68955679cebfacbdb521b838d3

          • C:\Users\Admin\AppData\Roaming\sig.cab

            Filesize

            75B

            MD5

            83396a6eca0cc08cd706bd005382f9b8

            SHA1

            82ff0b9f3bd4ba0ba6551feba002d0713b3440f9

            SHA256

            38a570d1b7b2aa20ea053e7d8e76c99e3849047268a35e2f9633403a21ddc7c3

            SHA512

            074f7a4c5000dc77daa947172819e36b33c625de141471e6c1a7cfd68d420f8152266d18f299dd61d7581332f18766c49c561ee37d327f47485dde9f3445bd9c

          • \Users\Admin\AppData\Roaming\SunJava\SunJava.exe

            Filesize

            110KB

            MD5

            877996da419cb48838d9769b24f6016c

            SHA1

            1bd1a5ef7668b1a26eaa0c96c3ad7140428b9597

            SHA256

            73bf5be5536bd29c3724da5c6424fcee62eea420edb29762d0a99125f7511e46

            SHA512

            d4752f4e250f7ffae3fcd77e6cfadcd5b5360f1e02618cb285b6d73fef8c580911b211fd09b33b0da5141d3d1c8f3d7923163b68955679cebfacbdb521b838d3

          • \Users\Admin\AppData\Roaming\SunJava\SunJava.exe

            Filesize

            110KB

            MD5

            877996da419cb48838d9769b24f6016c

            SHA1

            1bd1a5ef7668b1a26eaa0c96c3ad7140428b9597

            SHA256

            73bf5be5536bd29c3724da5c6424fcee62eea420edb29762d0a99125f7511e46

            SHA512

            d4752f4e250f7ffae3fcd77e6cfadcd5b5360f1e02618cb285b6d73fef8c580911b211fd09b33b0da5141d3d1c8f3d7923163b68955679cebfacbdb521b838d3

          • memory/800-79-0x0000000002300000-0x0000000002310000-memory.dmp

            Filesize

            64KB

          • memory/800-77-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

            Filesize

            8KB

          • memory/1128-76-0x0000000071751000-0x0000000071753000-memory.dmp

            Filesize

            8KB

          • memory/1544-73-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

          • memory/1544-69-0x00000000040F1000-0x0000000004F9D000-memory.dmp

            Filesize

            14.7MB

          • memory/1544-86-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

          • memory/1872-72-0x0000000007900000-0x0000000007934000-memory.dmp

            Filesize

            208KB

          • memory/1872-78-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

          • memory/1872-71-0x0000000007900000-0x0000000007934000-memory.dmp

            Filesize

            208KB

          • memory/1872-55-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

          • memory/1872-60-0x0000000004211000-0x00000000050BD000-memory.dmp

            Filesize

            14.7MB

          • memory/1872-59-0x0000000000400000-0x0000000000434000-memory.dmp

            Filesize

            208KB

          • memory/1872-58-0x0000000075841000-0x0000000075843000-memory.dmp

            Filesize

            8KB