Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 06:03

General

  • Target

    9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe

  • Size

    292KB

  • MD5

    977d6201a366a1dd0d3a7c36c2bb3b67

  • SHA1

    0d09c75a78a68d274bdc67eea184d492a4d9c569

  • SHA256

    9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

  • SHA512

    89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

  • SSDEEP

    6144:4DClU9LocwcrcywT4DMezsW+PsBl2Zh+hH80PsKKifn4m+8:Hy9LocwBT4DMefmMlY+58nKjf4

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1372
      • C:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe
        "C:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe
          C:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe
          3⤵
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2028
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\search.json.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\search.json.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1068
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\search.json.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\search.json.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1056
              • C:\Windows\SysWOW64\explorer.exe
                "C:\Windows\SysWOW64\explorer.exe"
                6⤵
                • Adds Run key to start application
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1204
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp1c9a9e09.bat"
            4⤵
            • Deletes itself
            PID:1520
    • C:\Program Files\Windows Mail\WinMail.exe
      "C:\Program Files\Windows Mail\WinMail.exe" -Embedding
      1⤵
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1992

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      340B

      MD5

      de1b509c5af2c3e4914d8304920b1264

      SHA1

      cf90d13a2fc2e7e61b3a14922df4a9b0b142a7b7

      SHA256

      8d8620cb5794b32368f156a3728dde78a4e881939772d49f9837371a31c6cb89

      SHA512

      0e4d125da62a5171bb0755e3b9eb1340a02399699ea133b14eba71e1bf829f0f42c9cd83e55604e9f499c0743454303710bdf557a653df38711cbb2d248316d6

    • C:\Users\Admin\AppData\Local\Temp\tmp1c9a9e09.bat

      Filesize

      307B

      MD5

      786b3c563887ce794a640e8271f01761

      SHA1

      76173dd494de504d6c93e9c380b112d479bb9d6f

      SHA256

      9713d8b10c571b6ba5e6df1d8012620b5a311ae0d15ea7dd80942144b26281fe

      SHA512

      2944ca910ac65d645cefe6dbd5c490fdb24218a8dd103a066e97dc97229397f27b5f7dc5bc92c98e0baa3d057b568308026ea6385fa8d3d15a7fbd4e855f67d0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\search.json.exe

      Filesize

      292KB

      MD5

      977d6201a366a1dd0d3a7c36c2bb3b67

      SHA1

      0d09c75a78a68d274bdc67eea184d492a4d9c569

      SHA256

      9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

      SHA512

      89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\search.json.exe

      Filesize

      292KB

      MD5

      977d6201a366a1dd0d3a7c36c2bb3b67

      SHA1

      0d09c75a78a68d274bdc67eea184d492a4d9c569

      SHA256

      9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

      SHA512

      89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\search.json.exe

      Filesize

      292KB

      MD5

      977d6201a366a1dd0d3a7c36c2bb3b67

      SHA1

      0d09c75a78a68d274bdc67eea184d492a4d9c569

      SHA256

      9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

      SHA512

      89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startupx\system.pif

      Filesize

      292KB

      MD5

      977d6201a366a1dd0d3a7c36c2bb3b67

      SHA1

      0d09c75a78a68d274bdc67eea184d492a4d9c569

      SHA256

      9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

      SHA512

      89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\search.json.exe

      Filesize

      292KB

      MD5

      977d6201a366a1dd0d3a7c36c2bb3b67

      SHA1

      0d09c75a78a68d274bdc67eea184d492a4d9c569

      SHA256

      9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

      SHA512

      89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\search.json.exe

      Filesize

      292KB

      MD5

      977d6201a366a1dd0d3a7c36c2bb3b67

      SHA1

      0d09c75a78a68d274bdc67eea184d492a4d9c569

      SHA256

      9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

      SHA512

      89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

    • memory/1056-114-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1056-98-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/1204-107-0x0000000000080000-0x00000000000AC000-memory.dmp

      Filesize

      176KB

    • memory/1204-103-0x0000000000080000-0x00000000000AC000-memory.dmp

      Filesize

      176KB

    • memory/1204-128-0x0000000000080000-0x00000000000AC000-memory.dmp

      Filesize

      176KB

    • memory/1204-112-0x0000000000080000-0x00000000000AC000-memory.dmp

      Filesize

      176KB

    • memory/1204-111-0x0000000074981000-0x0000000074983000-memory.dmp

      Filesize

      8KB

    • memory/1204-104-0x0000000000080000-0x00000000000AC000-memory.dmp

      Filesize

      176KB

    • memory/1204-106-0x0000000000080000-0x00000000000AC000-memory.dmp

      Filesize

      176KB

    • memory/1204-105-0x0000000000080000-0x00000000000AC000-memory.dmp

      Filesize

      176KB

    • memory/1204-100-0x0000000000080000-0x00000000000AC000-memory.dmp

      Filesize

      176KB

    • memory/1648-54-0x0000000075811000-0x0000000075813000-memory.dmp

      Filesize

      8KB

    • memory/1648-59-0x00000000002A0000-0x00000000002A4000-memory.dmp

      Filesize

      16KB

    • memory/1992-122-0x0000000002410000-0x0000000002420000-memory.dmp

      Filesize

      64KB

    • memory/1992-116-0x0000000002110000-0x0000000002120000-memory.dmp

      Filesize

      64KB

    • memory/1992-115-0x000007FEF6351000-0x000007FEF6353000-memory.dmp

      Filesize

      8KB

    • memory/1992-113-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

      Filesize

      8KB

    • memory/2028-64-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2028-73-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2028-66-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2028-69-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2028-58-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2028-70-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2028-72-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2028-57-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2028-63-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2028-61-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2028-102-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2028-74-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2028-55-0x00000000001B0000-0x00000000002AA000-memory.dmp

      Filesize

      1000KB