Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    164s
  • max time network
    169s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 16:26

General

  • Target

    ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe

  • Size

    228KB

  • MD5

    28a8fa3018628d6810fd4e4d4c8e9d8f

  • SHA1

    24c77e5a09f8b70fb7bfa0b50a457b16bdd1dc71

  • SHA256

    ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987

  • SHA512

    e7572e68cc72b5e96bc9c12f9dc3db73178392a62623f9aafde5ac1e7df44549d4b0885b91821279fb5b3a3c71b28ea280dd242d4c8c62ae90cea54934f2346a

  • SSDEEP

    6144:+kwgqvwrIP/G1p3lfGH7Uq7AGxdskm4fIYO:+AWwrcG39GH7ZjddFO

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1248
      • C:\Users\Admin\AppData\Local\Temp\ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe
        "C:\Users\Admin\AppData\Local\Temp\ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1876
        • C:\Users\Admin\AppData\Local\Temp\ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe
          "C:\Users\Admin\AppData\Local\Temp\ea18eb4621bdb37fe5a11649615c2a624af0eef076527ea5773697dfa1599987.exe"
          3⤵
          • Loads dropped DLL
          • Modifies Internet Explorer settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1480
          • C:\Users\Admin\AppData\Roaming\Ceraum\wylue.exe
            "C:\Users\Admin\AppData\Roaming\Ceraum\wylue.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:936
            • C:\Users\Admin\AppData\Roaming\Ceraum\wylue.exe
              "C:\Users\Admin\AppData\Roaming\Ceraum\wylue.exe"
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1412
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa2d1f6ed.bat"
            4⤵
            • Deletes itself
            PID:1136
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1212
      • C:\Windows\system32\taskhost.exe
        "taskhost.exe"
        1⤵
          PID:1124
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1336
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
            1⤵
              PID:1260

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpa2d1f6ed.bat

              Filesize

              307B

              MD5

              87cd58fb4eb0b93f43bd8373138c0844

              SHA1

              ca9c2a56908d38bad695263b7d3a21549aa0abdd

              SHA256

              715408e202ef010846a6ba3f2cea3a887179073f5ddb9877a854c1587397a131

              SHA512

              b2856732c938ef2cba891b028a5c79dfdd8b3c13413026b4dba24dad4381b40659c5a6590fac0cc67997435f65e022ecfcd45c1ada49d669bc788ce7d9aebf9e

            • C:\Users\Admin\AppData\Roaming\Ceraum\wylue.exe

              Filesize

              228KB

              MD5

              3776afcc8bcf783d162aa9c090a9f5f4

              SHA1

              729574170612557234ccba0a83fa4a026a18954b

              SHA256

              cd63167210c799efc4417ede7bd55e8ff97063ba0401597846f7d67bbda68403

              SHA512

              17dc83bc48b8cf5cc95c7a0ea8adf1dea3d9a8dfa17382b88b0fcc27f8de2d9f51060dc10f2a0a3466a6b2169151370a9d0654fcd60f28a16c88e5c1cb69324c

            • C:\Users\Admin\AppData\Roaming\Ceraum\wylue.exe

              Filesize

              228KB

              MD5

              3776afcc8bcf783d162aa9c090a9f5f4

              SHA1

              729574170612557234ccba0a83fa4a026a18954b

              SHA256

              cd63167210c799efc4417ede7bd55e8ff97063ba0401597846f7d67bbda68403

              SHA512

              17dc83bc48b8cf5cc95c7a0ea8adf1dea3d9a8dfa17382b88b0fcc27f8de2d9f51060dc10f2a0a3466a6b2169151370a9d0654fcd60f28a16c88e5c1cb69324c

            • C:\Users\Admin\AppData\Roaming\Ceraum\wylue.exe

              Filesize

              228KB

              MD5

              3776afcc8bcf783d162aa9c090a9f5f4

              SHA1

              729574170612557234ccba0a83fa4a026a18954b

              SHA256

              cd63167210c799efc4417ede7bd55e8ff97063ba0401597846f7d67bbda68403

              SHA512

              17dc83bc48b8cf5cc95c7a0ea8adf1dea3d9a8dfa17382b88b0fcc27f8de2d9f51060dc10f2a0a3466a6b2169151370a9d0654fcd60f28a16c88e5c1cb69324c

            • \Users\Admin\AppData\Roaming\Ceraum\wylue.exe

              Filesize

              228KB

              MD5

              3776afcc8bcf783d162aa9c090a9f5f4

              SHA1

              729574170612557234ccba0a83fa4a026a18954b

              SHA256

              cd63167210c799efc4417ede7bd55e8ff97063ba0401597846f7d67bbda68403

              SHA512

              17dc83bc48b8cf5cc95c7a0ea8adf1dea3d9a8dfa17382b88b0fcc27f8de2d9f51060dc10f2a0a3466a6b2169151370a9d0654fcd60f28a16c88e5c1cb69324c

            • \Users\Admin\AppData\Roaming\Ceraum\wylue.exe

              Filesize

              228KB

              MD5

              3776afcc8bcf783d162aa9c090a9f5f4

              SHA1

              729574170612557234ccba0a83fa4a026a18954b

              SHA256

              cd63167210c799efc4417ede7bd55e8ff97063ba0401597846f7d67bbda68403

              SHA512

              17dc83bc48b8cf5cc95c7a0ea8adf1dea3d9a8dfa17382b88b0fcc27f8de2d9f51060dc10f2a0a3466a6b2169151370a9d0654fcd60f28a16c88e5c1cb69324c

            • memory/1124-85-0x0000000001B80000-0x0000000001BBB000-memory.dmp

              Filesize

              236KB

            • memory/1124-86-0x0000000001B80000-0x0000000001BBB000-memory.dmp

              Filesize

              236KB

            • memory/1124-87-0x0000000001B80000-0x0000000001BBB000-memory.dmp

              Filesize

              236KB

            • memory/1124-88-0x0000000001B80000-0x0000000001BBB000-memory.dmp

              Filesize

              236KB

            • memory/1136-122-0x0000000000080000-0x00000000000BB000-memory.dmp

              Filesize

              236KB

            • memory/1136-123-0x0000000000080000-0x00000000000BB000-memory.dmp

              Filesize

              236KB

            • memory/1136-124-0x0000000000080000-0x00000000000BB000-memory.dmp

              Filesize

              236KB

            • memory/1136-120-0x0000000000080000-0x00000000000BB000-memory.dmp

              Filesize

              236KB

            • memory/1212-92-0x0000000001AC0000-0x0000000001AFB000-memory.dmp

              Filesize

              236KB

            • memory/1212-94-0x0000000001AC0000-0x0000000001AFB000-memory.dmp

              Filesize

              236KB

            • memory/1212-93-0x0000000001AC0000-0x0000000001AFB000-memory.dmp

              Filesize

              236KB

            • memory/1212-91-0x0000000001AC0000-0x0000000001AFB000-memory.dmp

              Filesize

              236KB

            • memory/1248-99-0x0000000002A60000-0x0000000002A9B000-memory.dmp

              Filesize

              236KB

            • memory/1248-98-0x0000000002A60000-0x0000000002A9B000-memory.dmp

              Filesize

              236KB

            • memory/1248-97-0x0000000002A60000-0x0000000002A9B000-memory.dmp

              Filesize

              236KB

            • memory/1248-100-0x0000000002A60000-0x0000000002A9B000-memory.dmp

              Filesize

              236KB

            • memory/1336-130-0x0000000003A50000-0x0000000003A8B000-memory.dmp

              Filesize

              236KB

            • memory/1336-129-0x0000000003A50000-0x0000000003A8B000-memory.dmp

              Filesize

              236KB

            • memory/1336-128-0x0000000003A50000-0x0000000003A8B000-memory.dmp

              Filesize

              236KB

            • memory/1412-138-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1412-121-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1480-113-0x0000000000350000-0x000000000038B000-memory.dmp

              Filesize

              236KB

            • memory/1480-61-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1480-109-0x0000000000350000-0x000000000038B000-memory.dmp

              Filesize

              236KB

            • memory/1480-104-0x0000000000350000-0x000000000038B000-memory.dmp

              Filesize

              236KB

            • memory/1480-115-0x0000000000350000-0x000000000038B000-memory.dmp

              Filesize

              236KB

            • memory/1480-111-0x0000000000350000-0x000000000038B000-memory.dmp

              Filesize

              236KB

            • memory/1480-117-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1480-106-0x0000000000350000-0x000000000038B000-memory.dmp

              Filesize

              236KB

            • memory/1480-107-0x0000000000350000-0x000000000038B000-memory.dmp

              Filesize

              236KB

            • memory/1480-59-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1480-58-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1480-56-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1480-55-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1480-105-0x0000000000350000-0x000000000038B000-memory.dmp

              Filesize

              236KB

            • memory/1480-103-0x0000000000350000-0x000000000038B000-memory.dmp

              Filesize

              236KB

            • memory/1480-65-0x0000000000400000-0x000000000043B000-memory.dmp

              Filesize

              236KB

            • memory/1876-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

              Filesize

              8KB