Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    177s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 21:26

General

  • Target

    eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe

  • Size

    3.2MB

  • MD5

    2acc4cff63991eea9db86c537732dbd6

  • SHA1

    81008190bcbbcea323a1ce980f7570822b4346f3

  • SHA256

    eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e

  • SHA512

    86300599a1426d28e2115ff0cf90f79eb80360d34ec3fdd2b47774515e592290b7904ff780a1a3fd2677ba6ccc08ea7914c97caee99a824f62cca34791b8786b

  • SSDEEP

    98304:S45RG0KmFIAG248jUB10g5gxwdg762/lS:LCO48A1x5eph/lS

Score
8/10

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe
    "C:\Users\Admin\AppData\Local\Temp\eb82aaf9a1d2832300b7739a1c3ae0ffec90f6c03a0b959e6a79735e4eeefb4e.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.cnlna.com/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:608
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:608 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:900
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /u /s C:\Windows\system32\SuperEC_Hook.dll
      2⤵
      • Loads dropped DLL
      PID:464
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x570
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:576

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PULJ7CSW\BWAU54W9.htm

    Filesize

    427B

    MD5

    774d13bb0fecd8fd1b141abc974c2840

    SHA1

    683c8cfb5b5d2fdaf704d9fd8c11885a024e0ee4

    SHA256

    4a89eebe118988c98ea41bc4540c8972a2e35ff2a616b933178dce75415191b8

    SHA512

    0759bc9280458afcba4d8a86fb179c98a34f985049d50b4a14c4949d7c99a5c689474a77c9f3564e2ae06a891d53319bf82626ff60cd858e4dda6b93d16e5792

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UHW5B3KP.txt

    Filesize

    601B

    MD5

    9d1c1df8e8e5cf52ff20e8fcfb7fee21

    SHA1

    9668b760c4999e91c4a3b283ce95e130d1794bf5

    SHA256

    b5eac05ca3bfcb3af5baf1e6a3ecf6bb9d8d9fcb1504e97842897b683e5183ab

    SHA512

    5fa4b9a8361221c5f7c716a24a8d16d8a5084bcedda9ec61ba05a9935b1f0bc2ce7ffbbc57fdfe085885a2b5720005bc6fbbd777da642ba6b065a385bbe32165

  • C:\Windows\SysWOW64\SuperEC_Hook.dll

    Filesize

    368KB

    MD5

    6446f02463634295797ff698eb7eb92e

    SHA1

    64a20417acf7c9bd67efc601236c85fa640426a8

    SHA256

    53022e175ff09af40a8569a641a261ed08dabc7331afbdde97f2f3d6f9321b33

    SHA512

    eeeb4152b92f9c4cad35d596f6fdec8d4e26b93c1a71627007ce5e490c46bd7773cc65309645ace429467b335fea5fe33cb5aac4cf507367cd9ad72a1b9efbfe

  • \Windows\SysWOW64\SuperEC_Hook.dll

    Filesize

    368KB

    MD5

    6446f02463634295797ff698eb7eb92e

    SHA1

    64a20417acf7c9bd67efc601236c85fa640426a8

    SHA256

    53022e175ff09af40a8569a641a261ed08dabc7331afbdde97f2f3d6f9321b33

    SHA512

    eeeb4152b92f9c4cad35d596f6fdec8d4e26b93c1a71627007ce5e490c46bd7773cc65309645ace429467b335fea5fe33cb5aac4cf507367cd9ad72a1b9efbfe

  • memory/464-4862-0x0000000016080000-0x0000000016152000-memory.dmp

    Filesize

    840KB

  • memory/1408-496-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-497-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-467-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-468-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-466-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-465-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-464-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-463-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-493-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-472-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-471-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-470-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-469-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-475-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-476-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-474-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-477-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-478-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-479-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-483-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-484-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-482-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-481-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-480-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-486-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-498-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-490-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-491-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-489-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-488-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-487-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-495-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-55-0x0000000000400000-0x000000000073E000-memory.dmp

    Filesize

    3.2MB

  • memory/1408-494-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-473-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-57-0x0000000075120000-0x0000000075167000-memory.dmp

    Filesize

    284KB

  • memory/1408-485-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-492-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-501-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-502-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-500-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-499-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-503-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-506-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-504-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-505-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-507-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-510-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-508-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-509-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-512-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-511-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-524-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-523-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-522-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-521-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-520-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-519-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-518-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-517-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-516-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-515-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-514-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-513-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-1331-0x00000000020F0000-0x00000000021F0000-memory.dmp

    Filesize

    1024KB

  • memory/1408-1332-0x0000000002230000-0x00000000023B1000-memory.dmp

    Filesize

    1.5MB

  • memory/1408-3960-0x00000000020F0000-0x00000000021F0000-memory.dmp

    Filesize

    1024KB

  • memory/1408-4810-0x00000000024E0000-0x00000000025F1000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-4811-0x0000000002600000-0x0000000002701000-memory.dmp

    Filesize

    1.0MB

  • memory/1408-4855-0x0000000010000000-0x000000001003F000-memory.dmp

    Filesize

    252KB

  • memory/1408-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

    Filesize

    8KB

  • memory/1408-4863-0x0000000000400000-0x000000000073E000-memory.dmp

    Filesize

    3.2MB