Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 03:50

General

  • Target

    db3b7adfcede8ae8e5819e565b718ab5c9fd0d4446713da53cf21bd8977eee3c.dll

  • Size

    167KB

  • MD5

    bed9949fb26ab7de2c6d6166ec021122

  • SHA1

    c7cd86850cf2e8edff39363890825d1260a3a27e

  • SHA256

    db3b7adfcede8ae8e5819e565b718ab5c9fd0d4446713da53cf21bd8977eee3c

  • SHA512

    7fddf9de5f9aadcb04d2c543d9c587883dc02729b0e17dd597350efef0cbd7b826d6d8e1079a880d81beadf43140ada178b48ce409cfe42c79f934720d9bcf71

  • SSDEEP

    3072:SHogy7ibpASrDSOrjygB7SZEoWoL8LRsvUC:veaaDL7JRLRsvUC

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\db3b7adfcede8ae8e5819e565b718ab5c9fd0d4446713da53cf21bd8977eee3c.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1000
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\db3b7adfcede8ae8e5819e565b718ab5c9fd0d4446713da53cf21bd8977eee3c.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:840
      • C:\PROGRA~3\lsass.exe
        C:\PROGRA~3\lsass.exe C:\Users\Admin\AppData\Local\Temp\db3b7adfcede8ae8e5819e565b718ab5c9fd0d4446713da53cf21bd8977eee3c.dll,GOF1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1300
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:876
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:876 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:988
          • C:\Windows\system32\ctfmon.exe
            ctfmon.exe
            5⤵
              PID:1836

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PROGRA~3\lsass.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • C:\PROGRA~3\lsass.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6K7YHNQ9.txt

      Filesize

      608B

      MD5

      8d289fe5f13a781f95785afcb0e062e8

      SHA1

      73758546dc1a61d2f0d33d878d1673dae47671dc

      SHA256

      03bdcbbbf40d75c0ec752982292215346c480394c1112f2ec0f458a4a486f031

      SHA512

      e0302b86b702949252b214fdd9654d8a78072fb353f1587f90fb398f25539b391cce6f79eb9fc374d1fe4be4c3024fd4e8f9a538c7da3297fca6a14d4946aa41

    • \PROGRA~3\lsass.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • \PROGRA~3\lsass.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • memory/840-55-0x0000000076561000-0x0000000076563000-memory.dmp

      Filesize

      8KB

    • memory/840-56-0x0000000060000000-0x000000006007D000-memory.dmp

      Filesize

      500KB

    • memory/1300-62-0x0000000060000000-0x000000006007D000-memory.dmp

      Filesize

      500KB