Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    126s
  • max time network
    70s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28/11/2022, 04:28

General

  • Target

    a109132c0b88c58a79fc6fcf05ec7351cea81dcd4aeae58d44d361ecada56c3c.exe

  • Size

    3.5MB

  • MD5

    55f0d3df522944e35ac1226f39429a55

  • SHA1

    8b6c8f80b0bffab29a0c6f0ebca29982fec2f1b7

  • SHA256

    a109132c0b88c58a79fc6fcf05ec7351cea81dcd4aeae58d44d361ecada56c3c

  • SHA512

    ac93404723cf19c8232886debeed9cb087ada64dadfa8f494a8607f85c1381b466cbb53ba074d68d6a65e70da085bfe79ae7d10e486ebf2585eee68c873e73a7

  • SSDEEP

    49152:Z5vleLEv0Lnt2OD9NHBu0KgoqAcpxWN5xHawdRqpJTK5Aj3We/ZSMTwwTFs:ZEo0rwOBUgoJcmNWwdRqXB3P/8fwTK

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 14 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a109132c0b88c58a79fc6fcf05ec7351cea81dcd4aeae58d44d361ecada56c3c.exe
    "C:\Users\Admin\AppData\Local\Temp\a109132c0b88c58a79fc6fcf05ec7351cea81dcd4aeae58d44d361ecada56c3c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:968
    • C:\Users\Admin\AppData\Local\Temp\Super_Updater.exe
      /VERYSILENT
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1904
      • C:\Users\Admin\AppData\Local\Temp\is-A61HB.tmp\Super_Updater.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-A61HB.tmp\Super_Updater.tmp" /SL5="$60124,2930093,491520,C:\Users\Admin\AppData\Local\Temp\Super_Updater.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1696
        • C:\Program Files (x86)\Super Updater\SUTray.exe
          "C:\Program Files (x86)\Super Updater\SUTray.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:964
        • C:\Program Files (x86)\Super Updater\SuperUpdater.exe
          "C:\Program Files (x86)\Super Updater\SuperUpdater.exe" /INSTALL
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:928
        • C:\Program Files (x86)\Super Updater\SUStartScan.exe
          "C:\Program Files (x86)\Super Updater\SUStartScan.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1828
          • C:\Program Files (x86)\Super Updater\SuperUpdater.exe
            "C:\Program Files (x86)\Super Updater\SuperUpdater.exe" /START
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1804
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Super Updater Schedule" /TR "\"C:\Program Files (x86)\Super Updater\SUTray.exe\"" /SC ONLOGON /RL HIGHEST /F
              6⤵
              • Creates scheduled task(s)
              PID:1488

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Super Updater\English.ini

    Filesize

    12KB

    MD5

    6b6c850523932d108113d6937d034159

    SHA1

    d575609103a02d3f5a4a15da1f6acda2e5b115b0

    SHA256

    88bc0c7ebe7ec1de4ce4bcbf7810d8c0f45e1185e792b4ea8865c0968e8bf653

    SHA512

    c4539658108fe14ae21a4c3c345f363bd18bfbde3b4443cb8c4df7f7a745e1512b20975cd57114e3904e0e8b1ed61c04112b01e832a3c365b402853c5577ca4c

  • C:\Program Files (x86)\Super Updater\SUStartScan.exe

    Filesize

    934KB

    MD5

    48922bd2da507e99dcbe54ac2870c3ee

    SHA1

    c5007e3c8d1d8ff27dd32c9c24611a0ef935711f

    SHA256

    ef9419ef231538e55a8dc1ed96c83638e3e70f14a96eac94228da3a8589fccd2

    SHA512

    7905e5e8db841d38df6e440a2ddc3518d4421f49f9a87084e4f337d7401d715a5b406ae1eea57c82d54997ce0dd06710622d01f1ce2c60849bb5a27eb7826386

  • C:\Program Files (x86)\Super Updater\SUTray.exe

    Filesize

    926KB

    MD5

    a82fed4858c32b82e2fd1f3e592dac5e

    SHA1

    f3d8ba2805b20777405df53bae008bfaabb93cbd

    SHA256

    e2b95ae6fd38af02d28025271e2307331e15f54e6d46c3871233b5a2f4db390d

    SHA512

    f2748de86a73608a158cfb771c1e7d79d107aa5b3445b92aff601c0dd3735c0123ac297cb327d904f3bee8170589abc74dda39545ca47e2431963f221465e564

  • C:\Program Files (x86)\Super Updater\SuperUpdater.exe

    Filesize

    3.5MB

    MD5

    5748528b3d50f53bc691e4098d65f34f

    SHA1

    3e04e93ed72cd553095e1b6699cbf99f690c0928

    SHA256

    ff40d3c4a3f8e0fba82fda32fd52499c7973156f1f53a4431cae73205dd7d40f

    SHA512

    c5870828e390a38b2524643cf80f9e7d2b5f44d75139d42e7e05d620326f58c79e9b59f3c3663ab962f3bf9b0f86d19c74ac1b17acecf4473fda27f8b9f65028

  • C:\Program Files (x86)\Super Updater\SuperUpdater.exe

    Filesize

    3.5MB

    MD5

    5748528b3d50f53bc691e4098d65f34f

    SHA1

    3e04e93ed72cd553095e1b6699cbf99f690c0928

    SHA256

    ff40d3c4a3f8e0fba82fda32fd52499c7973156f1f53a4431cae73205dd7d40f

    SHA512

    c5870828e390a38b2524643cf80f9e7d2b5f44d75139d42e7e05d620326f58c79e9b59f3c3663ab962f3bf9b0f86d19c74ac1b17acecf4473fda27f8b9f65028

  • C:\Program Files (x86)\Super Updater\SuperUpdater.exe

    Filesize

    3.5MB

    MD5

    5748528b3d50f53bc691e4098d65f34f

    SHA1

    3e04e93ed72cd553095e1b6699cbf99f690c0928

    SHA256

    ff40d3c4a3f8e0fba82fda32fd52499c7973156f1f53a4431cae73205dd7d40f

    SHA512

    c5870828e390a38b2524643cf80f9e7d2b5f44d75139d42e7e05d620326f58c79e9b59f3c3663ab962f3bf9b0f86d19c74ac1b17acecf4473fda27f8b9f65028

  • C:\Program Files (x86)\Super Updater\sqlite3.dll

    Filesize

    508KB

    MD5

    0f66e8e2340569fb17e774dac2010e31

    SHA1

    406bb6854e7384ff77c0b847bf2f24f3315874a3

    SHA256

    de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f

    SHA512

    39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05

  • C:\Users\Admin\AppData\Local\Temp\Super_Updater.exe

    Filesize

    3.3MB

    MD5

    2c2d442431a1b685b5fe5ae11d1a3cdc

    SHA1

    70e59130e3229e397e13fe408fb3c7a5fd520001

    SHA256

    20abc30501c749cc4541ed3104cd26a825a4f6e8d8a5381938caef2b0ea49b6e

    SHA512

    082925808f6fbeae3074f8108041c6580c2d3b1968f096f9fdcb0c2d2ca4a05802870f43b7d46f8b389cdbc05d34f89822fa985b1759aad7f71a99119f6a61e0

  • C:\Users\Admin\AppData\Local\Temp\Super_Updater.exe

    Filesize

    3.3MB

    MD5

    2c2d442431a1b685b5fe5ae11d1a3cdc

    SHA1

    70e59130e3229e397e13fe408fb3c7a5fd520001

    SHA256

    20abc30501c749cc4541ed3104cd26a825a4f6e8d8a5381938caef2b0ea49b6e

    SHA512

    082925808f6fbeae3074f8108041c6580c2d3b1968f096f9fdcb0c2d2ca4a05802870f43b7d46f8b389cdbc05d34f89822fa985b1759aad7f71a99119f6a61e0

  • C:\Users\Admin\AppData\Local\Temp\is-A61HB.tmp\Super_Updater.tmp

    Filesize

    1.5MB

    MD5

    be27fdbe242476544b45aed4518c4a4a

    SHA1

    d7215e1307c2d16c2352ceab9286a23b522d5132

    SHA256

    366d21286f2e8f80626d5e59c5137db4ddbb880b964ddb1ddba8952a21720cb7

    SHA512

    6594ab889d32ecc86d8fb19e0bb07a13277b44a944080ea16b0e0f07577261a1da2cb7397c84fef2880c59abaa61f810b248aab779861f45271449b83aa52b14

  • C:\Users\Admin\AppData\Local\Temp\is-A61HB.tmp\Super_Updater.tmp

    Filesize

    1.5MB

    MD5

    be27fdbe242476544b45aed4518c4a4a

    SHA1

    d7215e1307c2d16c2352ceab9286a23b522d5132

    SHA256

    366d21286f2e8f80626d5e59c5137db4ddbb880b964ddb1ddba8952a21720cb7

    SHA512

    6594ab889d32ecc86d8fb19e0bb07a13277b44a944080ea16b0e0f07577261a1da2cb7397c84fef2880c59abaa61f810b248aab779861f45271449b83aa52b14

  • C:\Users\Admin\AppData\Roaming\Super Updater\program.log

    Filesize

    290B

    MD5

    5335700fd74e64e55917350a722a13a9

    SHA1

    35d335dbf88f483c797654ff5dcff1b1baa2cf9f

    SHA256

    0f4a855e66fe12e8982a58e2db5aac6938df93f1b468f19713b43a8df379c914

    SHA512

    f8113874c0aa708f0b423abd14dcdea2e81697222ae019b2d763a077da2f03776e929962b02d8c3823016c8034bd19a3f4bc9c293f24f1874663f90b3d61d497

  • \Program Files (x86)\Super Updater\SUStartScan.exe

    Filesize

    934KB

    MD5

    48922bd2da507e99dcbe54ac2870c3ee

    SHA1

    c5007e3c8d1d8ff27dd32c9c24611a0ef935711f

    SHA256

    ef9419ef231538e55a8dc1ed96c83638e3e70f14a96eac94228da3a8589fccd2

    SHA512

    7905e5e8db841d38df6e440a2ddc3518d4421f49f9a87084e4f337d7401d715a5b406ae1eea57c82d54997ce0dd06710622d01f1ce2c60849bb5a27eb7826386

  • \Program Files (x86)\Super Updater\SUTray.exe

    Filesize

    926KB

    MD5

    a82fed4858c32b82e2fd1f3e592dac5e

    SHA1

    f3d8ba2805b20777405df53bae008bfaabb93cbd

    SHA256

    e2b95ae6fd38af02d28025271e2307331e15f54e6d46c3871233b5a2f4db390d

    SHA512

    f2748de86a73608a158cfb771c1e7d79d107aa5b3445b92aff601c0dd3735c0123ac297cb327d904f3bee8170589abc74dda39545ca47e2431963f221465e564

  • \Program Files (x86)\Super Updater\SuperUpdater.exe

    Filesize

    3.5MB

    MD5

    5748528b3d50f53bc691e4098d65f34f

    SHA1

    3e04e93ed72cd553095e1b6699cbf99f690c0928

    SHA256

    ff40d3c4a3f8e0fba82fda32fd52499c7973156f1f53a4431cae73205dd7d40f

    SHA512

    c5870828e390a38b2524643cf80f9e7d2b5f44d75139d42e7e05d620326f58c79e9b59f3c3663ab962f3bf9b0f86d19c74ac1b17acecf4473fda27f8b9f65028

  • \Program Files (x86)\Super Updater\SuperUpdater.exe

    Filesize

    3.5MB

    MD5

    5748528b3d50f53bc691e4098d65f34f

    SHA1

    3e04e93ed72cd553095e1b6699cbf99f690c0928

    SHA256

    ff40d3c4a3f8e0fba82fda32fd52499c7973156f1f53a4431cae73205dd7d40f

    SHA512

    c5870828e390a38b2524643cf80f9e7d2b5f44d75139d42e7e05d620326f58c79e9b59f3c3663ab962f3bf9b0f86d19c74ac1b17acecf4473fda27f8b9f65028

  • \Program Files (x86)\Super Updater\SuperUpdater.exe

    Filesize

    3.5MB

    MD5

    5748528b3d50f53bc691e4098d65f34f

    SHA1

    3e04e93ed72cd553095e1b6699cbf99f690c0928

    SHA256

    ff40d3c4a3f8e0fba82fda32fd52499c7973156f1f53a4431cae73205dd7d40f

    SHA512

    c5870828e390a38b2524643cf80f9e7d2b5f44d75139d42e7e05d620326f58c79e9b59f3c3663ab962f3bf9b0f86d19c74ac1b17acecf4473fda27f8b9f65028

  • \Program Files (x86)\Super Updater\SuperUpdater.exe

    Filesize

    3.5MB

    MD5

    5748528b3d50f53bc691e4098d65f34f

    SHA1

    3e04e93ed72cd553095e1b6699cbf99f690c0928

    SHA256

    ff40d3c4a3f8e0fba82fda32fd52499c7973156f1f53a4431cae73205dd7d40f

    SHA512

    c5870828e390a38b2524643cf80f9e7d2b5f44d75139d42e7e05d620326f58c79e9b59f3c3663ab962f3bf9b0f86d19c74ac1b17acecf4473fda27f8b9f65028

  • \Program Files (x86)\Super Updater\SuperUpdater.exe

    Filesize

    3.5MB

    MD5

    5748528b3d50f53bc691e4098d65f34f

    SHA1

    3e04e93ed72cd553095e1b6699cbf99f690c0928

    SHA256

    ff40d3c4a3f8e0fba82fda32fd52499c7973156f1f53a4431cae73205dd7d40f

    SHA512

    c5870828e390a38b2524643cf80f9e7d2b5f44d75139d42e7e05d620326f58c79e9b59f3c3663ab962f3bf9b0f86d19c74ac1b17acecf4473fda27f8b9f65028

  • \Program Files (x86)\Super Updater\sqlite3.dll

    Filesize

    508KB

    MD5

    0f66e8e2340569fb17e774dac2010e31

    SHA1

    406bb6854e7384ff77c0b847bf2f24f3315874a3

    SHA256

    de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f

    SHA512

    39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05

  • \Program Files (x86)\Super Updater\sqlite3.dll

    Filesize

    508KB

    MD5

    0f66e8e2340569fb17e774dac2010e31

    SHA1

    406bb6854e7384ff77c0b847bf2f24f3315874a3

    SHA256

    de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f

    SHA512

    39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05

  • \Program Files (x86)\Super Updater\unins000.exe

    Filesize

    1.5MB

    MD5

    be27fdbe242476544b45aed4518c4a4a

    SHA1

    d7215e1307c2d16c2352ceab9286a23b522d5132

    SHA256

    366d21286f2e8f80626d5e59c5137db4ddbb880b964ddb1ddba8952a21720cb7

    SHA512

    6594ab889d32ecc86d8fb19e0bb07a13277b44a944080ea16b0e0f07577261a1da2cb7397c84fef2880c59abaa61f810b248aab779861f45271449b83aa52b14

  • \Users\Admin\AppData\Local\Temp\Super_Updater.exe

    Filesize

    3.3MB

    MD5

    2c2d442431a1b685b5fe5ae11d1a3cdc

    SHA1

    70e59130e3229e397e13fe408fb3c7a5fd520001

    SHA256

    20abc30501c749cc4541ed3104cd26a825a4f6e8d8a5381938caef2b0ea49b6e

    SHA512

    082925808f6fbeae3074f8108041c6580c2d3b1968f096f9fdcb0c2d2ca4a05802870f43b7d46f8b389cdbc05d34f89822fa985b1759aad7f71a99119f6a61e0

  • \Users\Admin\AppData\Local\Temp\is-A61HB.tmp\Super_Updater.tmp

    Filesize

    1.5MB

    MD5

    be27fdbe242476544b45aed4518c4a4a

    SHA1

    d7215e1307c2d16c2352ceab9286a23b522d5132

    SHA256

    366d21286f2e8f80626d5e59c5137db4ddbb880b964ddb1ddba8952a21720cb7

    SHA512

    6594ab889d32ecc86d8fb19e0bb07a13277b44a944080ea16b0e0f07577261a1da2cb7397c84fef2880c59abaa61f810b248aab779861f45271449b83aa52b14

  • \Users\Admin\AppData\Local\Temp\is-R80CL.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-R80CL.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/1696-68-0x00000000748B1000-0x00000000748B3000-memory.dmp

    Filesize

    8KB

  • memory/1904-89-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/1904-61-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/1904-58-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/1904-57-0x0000000075501000-0x0000000075503000-memory.dmp

    Filesize

    8KB