Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 13:09

General

  • Target

    42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe

  • Size

    123KB

  • MD5

    a30dbf724ce568b19a8c8ea8dbb8c086

  • SHA1

    c6e26604f5eb0bb030bc1c75fcb4ff287aacc2e9

  • SHA256

    42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1

  • SHA512

    55f06e25cc074e8dbd39ceb50617b89b4afe42d50365de41cd46e8581e91b5f0aea4372e0bd9b3466f1a5eba60a2f51b6bd4aa1f75ec6904e1fdc25669399138

  • SSDEEP

    3072:tLQuZUsS7a/G3CYVZ64GsbhFnhE0tRuX22CYJX+MHHVSCqKW:/UNvdVQ4GsbhI0KG23VrHVS6

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe
    "C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Windows\SysWOW64\mspaint.exe
        "C:\Windows\system32\mspaint.exe"
        3⤵
        • Deletes itself
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1492
    • C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe
      "C:\Users\Admin\AppData\Local\Temp\42e9ddea7b28662d8de87cf851ea968b3e9d0642596b941a928077dbfce62ed1.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1360
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1396
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:276
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:276 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1236

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\I7V6YU28.txt

    Filesize

    597B

    MD5

    362641ac609c43b8709822a8bbba4abc

    SHA1

    1c22ebfb7cf24d2e03fabf78bb54ac867fe3e692

    SHA256

    31ae49cfcee09d2131a13844ee64553e84a86f84bf95f82ccf9c0c127119d401

    SHA512

    138b833993e9aaa8eed6cd150c31c4f2f4c6b36a6b695cf17fbf7775b44a125e3f9b9cbf66b3e2d469c767ee9a84eb08b2990618df16ddd90f4893bcb4ab9868

  • memory/1360-241-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1360-244-0x0000000000300000-0x000000000034E000-memory.dmp

    Filesize

    312KB

  • memory/1360-91-0x0000000000300000-0x000000000034E000-memory.dmp

    Filesize

    312KB

  • memory/1360-62-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1360-64-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1360-66-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1360-68-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1360-113-0x0000000000300000-0x000000000034E000-memory.dmp

    Filesize

    312KB

  • memory/1360-70-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1360-60-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1360-108-0x0000000000300000-0x000000000034E000-memory.dmp

    Filesize

    312KB

  • memory/1360-76-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1360-103-0x0000000000300000-0x000000000034E000-memory.dmp

    Filesize

    312KB

  • memory/1360-119-0x0000000000300000-0x000000000034E000-memory.dmp

    Filesize

    312KB

  • memory/1360-80-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1360-97-0x0000000000300000-0x000000000034E000-memory.dmp

    Filesize

    312KB

  • memory/1360-144-0x0000000000300000-0x000000000034E000-memory.dmp

    Filesize

    312KB

  • memory/1360-124-0x0000000000300000-0x000000000034E000-memory.dmp

    Filesize

    312KB

  • memory/1492-120-0x0000000004280000-0x00000000042CE000-memory.dmp

    Filesize

    312KB

  • memory/1492-96-0x0000000004280000-0x00000000042CE000-memory.dmp

    Filesize

    312KB

  • memory/1492-155-0x0000000004280000-0x00000000042CE000-memory.dmp

    Filesize

    312KB

  • memory/1492-79-0x0000000000241000-0x0000000000243000-memory.dmp

    Filesize

    8KB

  • memory/1492-114-0x0000000004280000-0x00000000042CE000-memory.dmp

    Filesize

    312KB

  • memory/1492-101-0x0000000004280000-0x00000000042CE000-memory.dmp

    Filesize

    312KB

  • memory/1492-107-0x0000000004280000-0x00000000042CE000-memory.dmp

    Filesize

    312KB

  • memory/1492-305-0x0000000004280000-0x00000000042CE000-memory.dmp

    Filesize

    312KB

  • memory/1760-73-0x0000000000400000-0x000000000077E000-memory.dmp

    Filesize

    3.5MB

  • memory/1760-74-0x0000000000220000-0x0000000000234000-memory.dmp

    Filesize

    80KB

  • memory/1760-55-0x0000000000400000-0x000000000077E000-memory.dmp

    Filesize

    3.5MB

  • memory/1760-54-0x0000000075281000-0x0000000075283000-memory.dmp

    Filesize

    8KB

  • memory/1824-118-0x00000000001A0000-0x00000000001EE000-memory.dmp

    Filesize

    312KB

  • memory/1824-112-0x00000000001A0000-0x00000000001EE000-memory.dmp

    Filesize

    312KB

  • memory/1824-139-0x00000000001A0000-0x00000000001EE000-memory.dmp

    Filesize

    312KB

  • memory/1824-85-0x00000000001A0000-0x00000000001EE000-memory.dmp

    Filesize

    312KB

  • memory/1824-105-0x00000000001A0000-0x00000000001EE000-memory.dmp

    Filesize

    312KB

  • memory/1824-81-0x00000000000E0000-0x0000000000101000-memory.dmp

    Filesize

    132KB

  • memory/1824-98-0x00000000001A0000-0x00000000001EE000-memory.dmp

    Filesize

    312KB

  • memory/1824-88-0x00000000001A0000-0x00000000001EE000-memory.dmp

    Filesize

    312KB

  • memory/1824-304-0x00000000001A0000-0x00000000001EE000-memory.dmp

    Filesize

    312KB

  • memory/1824-57-0x00000000000E0000-0x0000000000101000-memory.dmp

    Filesize

    132KB

  • memory/1824-93-0x00000000001A0000-0x00000000001EE000-memory.dmp

    Filesize

    312KB