Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    159s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 20:06

General

  • Target

    d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe

  • Size

    1.3MB

  • MD5

    d101296ac9a37b696df64c3b8745c4de

  • SHA1

    fa6180be5f580c5477b4fab3a562cf403eeb604d

  • SHA256

    d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05

  • SHA512

    cba1c363f01116d0ece17e243fd9b720e6484fa99f8d71554d1df8f227eaa98ce782e199ca2b3e10dc973b24034910315bf1fd74a329e2995a934cf981ad0bcf

  • SSDEEP

    24576:oLI2haCRy3CUv1+oZi5hYRTpcNCV6h9CVVfQjwd0ynj67:oLI0y3bMvKxQjwd0ynj67

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe
    "C:\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Users\Admin\AppData\Local\Temp\setup080.exe
      C:\Users\Admin\AppData\Local\Temp\\setup080.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:896
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        3⤵
        • Modifies Installed Components in the registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Windows\system32\ctfmon.exe
          ctfmon.exe
          4⤵
            PID:1764
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ERASE /F C:\Users\Admin\AppData\Local\Temp\setup080.exe
          3⤵
            PID:1616
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Users\Admin\AppData\Local\Temp\\aa.bat
          2⤵
          • Deletes itself
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1864
          • C:\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe
            "C:\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe"
            3⤵
            • Executes dropped EXE
            PID:1124
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x48c
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1712

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\_.exe

        Filesize

        1.3MB

        MD5

        b67982870f0de61946a42e0cdf1ccb7b

        SHA1

        8881872a7b2328bec6cdbe9e051fc882115dc8d4

        SHA256

        719f11b77cece9693e400ffa8bb60dd4c45deca3e0044d9ac5405652d8492451

        SHA512

        437112579d92fddde0df362278736b7c92fa7685daf489bb3e6c3c8c4e127969f60ecfc18d8ff4db439a4ce6d2a3dfdffe70fabc37df924678745ab59a6968da

      • C:\Users\Admin\AppData\Local\Temp\aa.bat

        Filesize

        617B

        MD5

        608b136341b1305da56b14576b33b7be

        SHA1

        970af0fd797189d6a2f32f4b8c611c17b717ba06

        SHA256

        a5e6b0b7efb08cb633d99c149d96aca602f10d981d1b1a11b2bdf25c23559ced

        SHA512

        c64300ccda8996e296334a47c6a123c0f99ce8f7a03d1fe240c1706a35f41debe68d0c543aa25f6fd16972654b9a921026af4da72ca0ce3991ab61bc197fd803

      • C:\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe

        Filesize

        1.3MB

        MD5

        b67982870f0de61946a42e0cdf1ccb7b

        SHA1

        8881872a7b2328bec6cdbe9e051fc882115dc8d4

        SHA256

        719f11b77cece9693e400ffa8bb60dd4c45deca3e0044d9ac5405652d8492451

        SHA512

        437112579d92fddde0df362278736b7c92fa7685daf489bb3e6c3c8c4e127969f60ecfc18d8ff4db439a4ce6d2a3dfdffe70fabc37df924678745ab59a6968da

      • C:\Users\Admin\AppData\Local\Temp\setup080.exe

        Filesize

        15KB

        MD5

        46da55d3a9e9cd858dc3764e248a523c

        SHA1

        6b49fd398deb6694a21a54ad919add66dbbce67a

        SHA256

        ca09704d2a911bce2bc25a4d5881390497727c2f0968c0b0cacd8b40521920fc

        SHA512

        0ea972c4fb969aa6921c47feb24ca48aa6ccde28ea51ebbc1aa954f892ea784a092b2781e2e6348eddb44c47bbd7c6bb889d3f850666b96d3ff6e5c5b27828fe

      • C:\Users\Admin\AppData\Local\Temp\setup080.exe

        Filesize

        15KB

        MD5

        46da55d3a9e9cd858dc3764e248a523c

        SHA1

        6b49fd398deb6694a21a54ad919add66dbbce67a

        SHA256

        ca09704d2a911bce2bc25a4d5881390497727c2f0968c0b0cacd8b40521920fc

        SHA512

        0ea972c4fb969aa6921c47feb24ca48aa6ccde28ea51ebbc1aa954f892ea784a092b2781e2e6348eddb44c47bbd7c6bb889d3f850666b96d3ff6e5c5b27828fe

      • \Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe

        Filesize

        1.3MB

        MD5

        b67982870f0de61946a42e0cdf1ccb7b

        SHA1

        8881872a7b2328bec6cdbe9e051fc882115dc8d4

        SHA256

        719f11b77cece9693e400ffa8bb60dd4c45deca3e0044d9ac5405652d8492451

        SHA512

        437112579d92fddde0df362278736b7c92fa7685daf489bb3e6c3c8c4e127969f60ecfc18d8ff4db439a4ce6d2a3dfdffe70fabc37df924678745ab59a6968da

      • \Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe

        Filesize

        1.3MB

        MD5

        b67982870f0de61946a42e0cdf1ccb7b

        SHA1

        8881872a7b2328bec6cdbe9e051fc882115dc8d4

        SHA256

        719f11b77cece9693e400ffa8bb60dd4c45deca3e0044d9ac5405652d8492451

        SHA512

        437112579d92fddde0df362278736b7c92fa7685daf489bb3e6c3c8c4e127969f60ecfc18d8ff4db439a4ce6d2a3dfdffe70fabc37df924678745ab59a6968da

      • \Users\Admin\AppData\Local\Temp\setup080.exe

        Filesize

        15KB

        MD5

        46da55d3a9e9cd858dc3764e248a523c

        SHA1

        6b49fd398deb6694a21a54ad919add66dbbce67a

        SHA256

        ca09704d2a911bce2bc25a4d5881390497727c2f0968c0b0cacd8b40521920fc

        SHA512

        0ea972c4fb969aa6921c47feb24ca48aa6ccde28ea51ebbc1aa954f892ea784a092b2781e2e6348eddb44c47bbd7c6bb889d3f850666b96d3ff6e5c5b27828fe

      • \Users\Admin\AppData\Local\Temp\setup080.exe

        Filesize

        15KB

        MD5

        46da55d3a9e9cd858dc3764e248a523c

        SHA1

        6b49fd398deb6694a21a54ad919add66dbbce67a

        SHA256

        ca09704d2a911bce2bc25a4d5881390497727c2f0968c0b0cacd8b40521920fc

        SHA512

        0ea972c4fb969aa6921c47feb24ca48aa6ccde28ea51ebbc1aa954f892ea784a092b2781e2e6348eddb44c47bbd7c6bb889d3f850666b96d3ff6e5c5b27828fe

      • \Users\Admin\AppData\Local\Temp\setup080.exe

        Filesize

        15KB

        MD5

        46da55d3a9e9cd858dc3764e248a523c

        SHA1

        6b49fd398deb6694a21a54ad919add66dbbce67a

        SHA256

        ca09704d2a911bce2bc25a4d5881390497727c2f0968c0b0cacd8b40521920fc

        SHA512

        0ea972c4fb969aa6921c47feb24ca48aa6ccde28ea51ebbc1aa954f892ea784a092b2781e2e6348eddb44c47bbd7c6bb889d3f850666b96d3ff6e5c5b27828fe

      • memory/896-77-0x0000000000400000-0x0000000000406000-memory.dmp

        Filesize

        24KB

      • memory/896-67-0x0000000000020000-0x0000000000026000-memory.dmp

        Filesize

        24KB

      • memory/896-66-0x0000000000400000-0x0000000000406000-memory.dmp

        Filesize

        24KB

      • memory/1408-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

        Filesize

        8KB

      • memory/1408-65-0x0000000000250000-0x0000000000256000-memory.dmp

        Filesize

        24KB

      • memory/1552-63-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

        Filesize

        8KB

      • memory/1552-79-0x00000000025C0000-0x00000000025D0000-memory.dmp

        Filesize

        64KB