Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2022, 18:13

General

  • Target

    4af1f894b3735602812e010e429183034a2450d21f98c8a1d1a34910052ebc37.exe

  • Size

    349KB

  • MD5

    349eec488fb1bac558c6df35a8b9f4f6

  • SHA1

    c905d5735a43afbb3ca47e47e7627ed3878f7ce7

  • SHA256

    4af1f894b3735602812e010e429183034a2450d21f98c8a1d1a34910052ebc37

  • SHA512

    0dd96ed854a2fd4d4397dd59c9b595a1aca339883052dc8bb8c85b5fd86f25ae4074a26de1e951047119aa390373835daae038f3860b343a3ef7993b6f726b8c

  • SSDEEP

    6144:ye34zV2nu/EJXAF8u1qBhGNy4909VezjiGF+nh9CUZLcb+FL79k:snEJXs1q2N1906jidGUZLcb+Fn9k

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4af1f894b3735602812e010e429183034a2450d21f98c8a1d1a34910052ebc37.exe
    "C:\Users\Admin\AppData\Local\Temp\4af1f894b3735602812e010e429183034a2450d21f98c8a1d1a34910052ebc37.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\system32\cscript.exe" "C:\Program Files (x86)\EditPlus\kk50.icw"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Windows\SysWow64\WScript.exe
        "C:\Windows\SysWow64\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kk50.icw"
        3⤵
          PID:316
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2036
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:760
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1804

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\EditPlus\kk50.icw

      Filesize

      132B

      MD5

      adcb98ee80f8c7e954c4bc84c68a0534

      SHA1

      0717f8420743237a526dd725615291a05caa232a

      SHA256

      5661ac1fdb1e4132c14275b39919ad6a24a30430dfe510a3187ef2fa955ab3f3

      SHA512

      fbb779e484c466f1125169e81cccfff14b05eeb414c642f023a19ead13ed3fffc8c02282bd72d33790f60ecb2ebee0b9e7c5b186461ac4a603f2003e56873351

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Z2U4IAM8.txt

      Filesize

      608B

      MD5

      976a281eb26f839af29af732a25faa88

      SHA1

      44c1c025a81a76f5f2dd019f2280894ef8e33657

      SHA256

      6161278eb030be01a81c4751f76c0dc2ca2410a81a316a0037904b4f0c34a829

      SHA512

      9da69cd5a45be4194f039b21b372555cdc4e92a9758a9a249813aebd8e900898db96e2fd89b7dedcc9a3348b0fa9060ef731e3f91f506b76e0baa2bb8e968790

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe

      Filesize

      44KB

      MD5

      7c30927884213f4fe91bbe90b591b762

      SHA1

      65693828963f6b6a5cbea4c9e595e06f85490f6f

      SHA256

      9032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994

      SHA512

      8aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kk50.icw

      Filesize

      843B

      MD5

      f838c572c92a8b7fadf30fe9f8e71169

      SHA1

      6eabfed65e6c53fbdf34dc35e421bd7a9a461298

      SHA256

      f5d399cac94b6c716d4aff13ea35c6b3aed0164b09b5192ab14bda1e7975c51d

      SHA512

      7234e4de346fa560f79533cb6b2cd0f6198272b1d7e5e7672a6f83e1d36f6742ac6eb8ac5256c8da5088817df0ea422f5fdaf3f6734ca552f5bb9c628ba7d2c2

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\statistics.dll

      Filesize

      80KB

      MD5

      271d838f235c3d77964909b79e05cc3d

      SHA1

      e88316549fcbe9c4b4cec8001b63f439884974b9

      SHA256

      1919f130b200be8591051f325137fe0a976295c73f325853ca8167c7da53717e

      SHA512

      1a361ad7c4d9fe217a4fe9ae3056c09a2769941a1377cb91c414453c7cc0d54bc729fae3648c3369d619e86a2c2a2143894726fba657821dca482b8bf7a75419

    • \Users\Admin\AppData\Local\Temp\nst2464.tmp\System.dll

      Filesize

      11KB

      MD5

      c17103ae9072a06da581dec998343fc1

      SHA1

      b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

      SHA256

      dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

      SHA512

      d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    • \Users\Admin\AppData\Local\Temp\nst2464.tmp\nsExec.dll

      Filesize

      6KB

      MD5

      acc2b699edfea5bf5aae45aba3a41e96

      SHA1

      d2accf4d494e43ceb2cff69abe4dd17147d29cc2

      SHA256

      168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

      SHA512

      e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe

      Filesize

      44KB

      MD5

      7c30927884213f4fe91bbe90b591b762

      SHA1

      65693828963f6b6a5cbea4c9e595e06f85490f6f

      SHA256

      9032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994

      SHA512

      8aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\statistics.dll

      Filesize

      80KB

      MD5

      271d838f235c3d77964909b79e05cc3d

      SHA1

      e88316549fcbe9c4b4cec8001b63f439884974b9

      SHA256

      1919f130b200be8591051f325137fe0a976295c73f325853ca8167c7da53717e

      SHA512

      1a361ad7c4d9fe217a4fe9ae3056c09a2769941a1377cb91c414453c7cc0d54bc729fae3648c3369d619e86a2c2a2143894726fba657821dca482b8bf7a75419

    • memory/1752-54-0x0000000076261000-0x0000000076263000-memory.dmp

      Filesize

      8KB