Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    123s
  • max time network
    107s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 14:35

General

  • Target

    3c06667bfdc98ef352bcd962b6a35e6d7674d0e70ea0ea7d5998182bb60f5765.exe

  • Size

    3.2MB

  • MD5

    93443930760655fbb04dbade20886672

  • SHA1

    914650981b3f53a9de17db634551066cabf22b1f

  • SHA256

    3c06667bfdc98ef352bcd962b6a35e6d7674d0e70ea0ea7d5998182bb60f5765

  • SHA512

    c13f3d2c2cedf511324ef545fbcbd2799c3601d3f266b97e35b52a6cd1da79836c8dcaf1036cd54dd6ac84695a538a2784f25f07e4c786ad4a10417d05db1193

  • SSDEEP

    98304:PirMZWSW2lRWioYV/WBYz667H9lgi8HJri8pS:6rwWST8iLV/vz667fB8pLpS

Malware Config

Signatures

  • Modifies AppInit DLL entries 2 TTPs
  • Loads dropped DLL 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 1 IoCs
  • Modifies data under HKEY_USERS 51 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c06667bfdc98ef352bcd962b6a35e6d7674d0e70ea0ea7d5998182bb60f5765.exe
    "C:\Users\Admin\AppData\Local\Temp\3c06667bfdc98ef352bcd962b6a35e6d7674d0e70ea0ea7d5998182bb60f5765.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\tcfix\tcfix.dll",serv -install
      2⤵
      • Loads dropped DLL
      PID:1424
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\tcfix\tcfix.dll",serv
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\tcfix\tcfix.dll",serv
      2⤵
      • Loads dropped DLL
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:1436

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \??\c:\Program Files (x86)\tcfix\tcfix.dll

    Filesize

    2.2MB

    MD5

    9872cb260052d80084841e757894a916

    SHA1

    9d1dccab2c75522a62e78ebb2882372431d131bb

    SHA256

    a7610492e9d5e4851f169fef85fb1a2606d74ad20c0e9154a35804b22803e675

    SHA512

    9aa86d72c4366268f1dfb9d1b4603909c7859e7035cade9ef5f03547cfc42b5aaee8d5911b6b6054ee679bf1dae7da0957c119fd00f7d08219f5b672a3fac6e1

  • \Program Files (x86)\tcfix\tcfix.dll

    Filesize

    2.2MB

    MD5

    9872cb260052d80084841e757894a916

    SHA1

    9d1dccab2c75522a62e78ebb2882372431d131bb

    SHA256

    a7610492e9d5e4851f169fef85fb1a2606d74ad20c0e9154a35804b22803e675

    SHA512

    9aa86d72c4366268f1dfb9d1b4603909c7859e7035cade9ef5f03547cfc42b5aaee8d5911b6b6054ee679bf1dae7da0957c119fd00f7d08219f5b672a3fac6e1

  • \Program Files (x86)\tcfix\tcfix.dll

    Filesize

    2.2MB

    MD5

    9872cb260052d80084841e757894a916

    SHA1

    9d1dccab2c75522a62e78ebb2882372431d131bb

    SHA256

    a7610492e9d5e4851f169fef85fb1a2606d74ad20c0e9154a35804b22803e675

    SHA512

    9aa86d72c4366268f1dfb9d1b4603909c7859e7035cade9ef5f03547cfc42b5aaee8d5911b6b6054ee679bf1dae7da0957c119fd00f7d08219f5b672a3fac6e1

  • \Program Files (x86)\tcfix\tcfix.dll

    Filesize

    2.2MB

    MD5

    9872cb260052d80084841e757894a916

    SHA1

    9d1dccab2c75522a62e78ebb2882372431d131bb

    SHA256

    a7610492e9d5e4851f169fef85fb1a2606d74ad20c0e9154a35804b22803e675

    SHA512

    9aa86d72c4366268f1dfb9d1b4603909c7859e7035cade9ef5f03547cfc42b5aaee8d5911b6b6054ee679bf1dae7da0957c119fd00f7d08219f5b672a3fac6e1

  • \Program Files (x86)\tcfix\tcfix.dll

    Filesize

    2.2MB

    MD5

    9872cb260052d80084841e757894a916

    SHA1

    9d1dccab2c75522a62e78ebb2882372431d131bb

    SHA256

    a7610492e9d5e4851f169fef85fb1a2606d74ad20c0e9154a35804b22803e675

    SHA512

    9aa86d72c4366268f1dfb9d1b4603909c7859e7035cade9ef5f03547cfc42b5aaee8d5911b6b6054ee679bf1dae7da0957c119fd00f7d08219f5b672a3fac6e1

  • \Program Files (x86)\tcfix\tcfix.dll

    Filesize

    2.2MB

    MD5

    9872cb260052d80084841e757894a916

    SHA1

    9d1dccab2c75522a62e78ebb2882372431d131bb

    SHA256

    a7610492e9d5e4851f169fef85fb1a2606d74ad20c0e9154a35804b22803e675

    SHA512

    9aa86d72c4366268f1dfb9d1b4603909c7859e7035cade9ef5f03547cfc42b5aaee8d5911b6b6054ee679bf1dae7da0957c119fd00f7d08219f5b672a3fac6e1

  • \Program Files (x86)\tcfix\tcfix.dll

    Filesize

    2.2MB

    MD5

    9872cb260052d80084841e757894a916

    SHA1

    9d1dccab2c75522a62e78ebb2882372431d131bb

    SHA256

    a7610492e9d5e4851f169fef85fb1a2606d74ad20c0e9154a35804b22803e675

    SHA512

    9aa86d72c4366268f1dfb9d1b4603909c7859e7035cade9ef5f03547cfc42b5aaee8d5911b6b6054ee679bf1dae7da0957c119fd00f7d08219f5b672a3fac6e1

  • \Program Files (x86)\tcfix\tcfix.dll

    Filesize

    2.2MB

    MD5

    9872cb260052d80084841e757894a916

    SHA1

    9d1dccab2c75522a62e78ebb2882372431d131bb

    SHA256

    a7610492e9d5e4851f169fef85fb1a2606d74ad20c0e9154a35804b22803e675

    SHA512

    9aa86d72c4366268f1dfb9d1b4603909c7859e7035cade9ef5f03547cfc42b5aaee8d5911b6b6054ee679bf1dae7da0957c119fd00f7d08219f5b672a3fac6e1

  • \Program Files (x86)\tcfix\tcfix.dll

    Filesize

    2.2MB

    MD5

    9872cb260052d80084841e757894a916

    SHA1

    9d1dccab2c75522a62e78ebb2882372431d131bb

    SHA256

    a7610492e9d5e4851f169fef85fb1a2606d74ad20c0e9154a35804b22803e675

    SHA512

    9aa86d72c4366268f1dfb9d1b4603909c7859e7035cade9ef5f03547cfc42b5aaee8d5911b6b6054ee679bf1dae7da0957c119fd00f7d08219f5b672a3fac6e1

  • \Program Files (x86)\tcfix\tcfix.dll

    Filesize

    2.2MB

    MD5

    9872cb260052d80084841e757894a916

    SHA1

    9d1dccab2c75522a62e78ebb2882372431d131bb

    SHA256

    a7610492e9d5e4851f169fef85fb1a2606d74ad20c0e9154a35804b22803e675

    SHA512

    9aa86d72c4366268f1dfb9d1b4603909c7859e7035cade9ef5f03547cfc42b5aaee8d5911b6b6054ee679bf1dae7da0957c119fd00f7d08219f5b672a3fac6e1

  • \Users\Admin\AppData\Local\Temp\tf58ad63ac.dll

    Filesize

    2.2MB

    MD5

    9872cb260052d80084841e757894a916

    SHA1

    9d1dccab2c75522a62e78ebb2882372431d131bb

    SHA256

    a7610492e9d5e4851f169fef85fb1a2606d74ad20c0e9154a35804b22803e675

    SHA512

    9aa86d72c4366268f1dfb9d1b4603909c7859e7035cade9ef5f03547cfc42b5aaee8d5911b6b6054ee679bf1dae7da0957c119fd00f7d08219f5b672a3fac6e1

  • memory/1168-61-0x000000007E7B0000-0x000000007EB08000-memory.dmp

    Filesize

    3.3MB

  • memory/1168-59-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

    Filesize

    8KB

  • memory/1168-54-0x000000007EC60000-0x000000007EFAC000-memory.dmp

    Filesize

    3.3MB

  • memory/1424-73-0x000000007EC50000-0x000000007EFA8000-memory.dmp

    Filesize

    3.3MB

  • memory/1436-84-0x000000007EC50000-0x000000007EFA8000-memory.dmp

    Filesize

    3.3MB