Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 14:49

General

  • Target

    af7c978196579d2d14db30a488bd1d89c147c9e7ab5b50aed730c515076751d1.exe

  • Size

    361KB

  • MD5

    562cbf4546a3f48af1f772502289edb1

  • SHA1

    c2b9469d5d69b18a69aca5e22afd3f7dfa8c2b64

  • SHA256

    af7c978196579d2d14db30a488bd1d89c147c9e7ab5b50aed730c515076751d1

  • SHA512

    21e9c1809f4f503518dd0ce6815b5dbbd7fe415af7b49b93c15449b9fbfe5e9e95f9da7e8b407663a31989a9872923eb357ece892cbb4b581ba071201021fef8

  • SSDEEP

    6144:1flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:1flfAsiVGjSGecvX

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af7c978196579d2d14db30a488bd1d89c147c9e7ab5b50aed730c515076751d1.exe
    "C:\Users\Admin\AppData\Local\Temp\af7c978196579d2d14db30a488bd1d89c147c9e7ab5b50aed730c515076751d1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1008
    • C:\Temp\qgcxtpnbwsrmidrq.exe
      C:\Temp\qgcxtpnbwsrmidrq.exe run
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1656
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1552
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:940

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\qgcxtpnbwsrmidrq.exe

    Filesize

    361KB

    MD5

    a6191f8c80dcac85edd74f67535bb3d8

    SHA1

    158b361272ac95b1a479e30e75c4eeafed3022c1

    SHA256

    68042c3b1794e98b729e19c7f1383903364c800a260706ca386d92afb1527874

    SHA512

    e8012fbe5d45074eb1faae8c4781c60d80ef9ff93d6153b38d938eb2ab21bb9079ef599d5ee155e1428efcbf46f6547478c3db27546ee5f53f0321c741c286c8

  • \Temp\qgcxtpnbwsrmidrq.exe

    Filesize

    361KB

    MD5

    a6191f8c80dcac85edd74f67535bb3d8

    SHA1

    158b361272ac95b1a479e30e75c4eeafed3022c1

    SHA256

    68042c3b1794e98b729e19c7f1383903364c800a260706ca386d92afb1527874

    SHA512

    e8012fbe5d45074eb1faae8c4781c60d80ef9ff93d6153b38d938eb2ab21bb9079ef599d5ee155e1428efcbf46f6547478c3db27546ee5f53f0321c741c286c8