Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 14:51

General

  • Target

    8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe

  • Size

    361KB

  • MD5

    364042307f2355a2fda16afe8706ccb1

  • SHA1

    1c7ebaa618624e5c97e24cfaf0f0b00ce9fc8ca0

  • SHA256

    8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120

  • SHA512

    c30c9a090ace855bfaab937fe9c165c6e82235bfb690426402f3d23369989dde82e63b90d94e642b09ddf4bacc681f9023725da5655db6ca6fe877b44d21d0c8

  • SSDEEP

    6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe
    "C:\Users\Admin\AppData\Local\Temp\8789432945e7600cae4d3fda3db030f726200d09b2207f8eeb55043199213120.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Temp\idzsojxtlhdzvfbx.exe
      C:\Temp\idzsojxtlhdzvfbx.exe run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\dzwtpmfczv.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1200
        • C:\Temp\dzwtpmfczv.exe
          C:\Temp\dzwtpmfczv.exe ups_run
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:524
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:580
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:584
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1552
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:700

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1c2e3a061866235f2d3a53a5bb0f30ea

    SHA1

    43e77de1758fabd4ce4f9ef0caa94dc9616e3f49

    SHA256

    cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226

    SHA512

    4d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8

  • C:\Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1c2e3a061866235f2d3a53a5bb0f30ea

    SHA1

    43e77de1758fabd4ce4f9ef0caa94dc9616e3f49

    SHA256

    cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226

    SHA512

    4d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8

  • C:\Temp\dzwtpmfczv.exe

    Filesize

    361KB

    MD5

    4d1edb8c8fb55848518f87d114b0535b

    SHA1

    2cbc3a0866e220d973979967fbbfe35c6d8929c7

    SHA256

    ec6c82b029e79e25157225f1483a8e29c21e58709c9211b7cbd202e75b244a42

    SHA512

    8038dde23f09ec1064ca0075296d986c1de2d2bfaa375e6bf87271697de38691114adbef8a21e5abb259c7355119cdce38ccd0314a50e239fca54095568d949f

  • C:\Temp\idzsojxtlhdzvfbx.exe

    Filesize

    361KB

    MD5

    ecc41986108e2643945029264324a6b1

    SHA1

    6f4f0de6765d9cfbb0941344cf3409ae686d60c9

    SHA256

    c6e952203694013ac04cdb76885184088dc93dde38dd1ef0713472ddba2a9bc3

    SHA512

    66e85267864131c8ae1e587d026e687b99290df15ce85ba75147d6b4a45be9abb0f04d9315b87d4a67cdd603b82af18ec71a8dee73b2a255e4ebb3e9cb5c0e71

  • C:\Temp\idzsojxtlhdzvfbx.exe

    Filesize

    361KB

    MD5

    ecc41986108e2643945029264324a6b1

    SHA1

    6f4f0de6765d9cfbb0941344cf3409ae686d60c9

    SHA256

    c6e952203694013ac04cdb76885184088dc93dde38dd1ef0713472ddba2a9bc3

    SHA512

    66e85267864131c8ae1e587d026e687b99290df15ce85ba75147d6b4a45be9abb0f04d9315b87d4a67cdd603b82af18ec71a8dee73b2a255e4ebb3e9cb5c0e71

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K1LM5IGN.txt

    Filesize

    535B

    MD5

    e873841969698b3ff18555ed826ff29b

    SHA1

    750b6abba27f27842c49eef65c70523a46d45f22

    SHA256

    b224a04d6d720e2d6f1021294b9e12f01576faa4141ea7e5015d2d641493b05f

    SHA512

    0af776395bf9f0627652e50e580cc96bef5e199339340fb2eed2984321dbb4bc40027192ccddf504ba8f4726d1680cc6447efbb7d35afe6f3c215c7bd34a220f

  • C:\temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1c2e3a061866235f2d3a53a5bb0f30ea

    SHA1

    43e77de1758fabd4ce4f9ef0caa94dc9616e3f49

    SHA256

    cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226

    SHA512

    4d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1c2e3a061866235f2d3a53a5bb0f30ea

    SHA1

    43e77de1758fabd4ce4f9ef0caa94dc9616e3f49

    SHA256

    cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226

    SHA512

    4d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1c2e3a061866235f2d3a53a5bb0f30ea

    SHA1

    43e77de1758fabd4ce4f9ef0caa94dc9616e3f49

    SHA256

    cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226

    SHA512

    4d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    1c2e3a061866235f2d3a53a5bb0f30ea

    SHA1

    43e77de1758fabd4ce4f9ef0caa94dc9616e3f49

    SHA256

    cb0185fa75a3fc5139f1368238cad86c18ae6dd62925307b94a1cc3781c71226

    SHA512

    4d6d0d089a7e2be4c911cd150de455cfa2d156f7d0353a6a66d4c9960407e093f6a1488a9da3f2092185405023be42774db336d2e63ca16e3aff8e41e55719a8

  • \Temp\idzsojxtlhdzvfbx.exe

    Filesize

    361KB

    MD5

    ecc41986108e2643945029264324a6b1

    SHA1

    6f4f0de6765d9cfbb0941344cf3409ae686d60c9

    SHA256

    c6e952203694013ac04cdb76885184088dc93dde38dd1ef0713472ddba2a9bc3

    SHA512

    66e85267864131c8ae1e587d026e687b99290df15ce85ba75147d6b4a45be9abb0f04d9315b87d4a67cdd603b82af18ec71a8dee73b2a255e4ebb3e9cb5c0e71