Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 20:14

General

  • Target

    5a79b76087ba533fabf82d2c8c4e1edb2675bc0fae7f6b093f0fa92bcc881380.exe

  • Size

    361KB

  • MD5

    559c96b48faaf2f57bf43c130e978f97

  • SHA1

    988216910ed96a6847c03e847a628e69c7687be4

  • SHA256

    5a79b76087ba533fabf82d2c8c4e1edb2675bc0fae7f6b093f0fa92bcc881380

  • SHA512

    d2fefd26f9493e8ed748a0218129280eca86530f6992dd63a0fba4ba3b4ba1cdf9c5d2c067d18bc110d031e3395a29e371bf27d972642f84cfbff66a854c826f

  • SSDEEP

    6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 5 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a79b76087ba533fabf82d2c8c4e1edb2675bc0fae7f6b093f0fa92bcc881380.exe
    "C:\Users\Admin\AppData\Local\Temp\5a79b76087ba533fabf82d2c8c4e1edb2675bc0fae7f6b093f0fa92bcc881380.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Temp\zspieyrnzvohextn.exe
      C:\Temp\zspieyrnzvohextn.exe run
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:668
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\uelvflvcmw.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:828
        • C:\Temp\uelvflvcmw.exe
          C:\Temp\uelvflvcmw.exe ups_run
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1452
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1932
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1004
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_uelvflvcmw.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1304
        • C:\Temp\i_uelvflvcmw.exe
          C:\Temp\i_uelvflvcmw.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1984
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:576
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:576 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:884

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    e58920dd254f0d469966b2d69a04bba3

    SHA1

    d6fcae3ed35cd9c2d63ab9ab8104565d7d61258b

    SHA256

    18a7829d04b836fbabb95b26eb6f197de622e62668d2739a3570535a73eb2c36

    SHA512

    81d07be4b5fd38bf1497baf01fe118da5b2c539fb66bb400b807dab604dd2b18a6c1a9155419983e03c313e9ab08d85c686f38775bc1c6025d80670f67eb1a32

  • C:\Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    e58920dd254f0d469966b2d69a04bba3

    SHA1

    d6fcae3ed35cd9c2d63ab9ab8104565d7d61258b

    SHA256

    18a7829d04b836fbabb95b26eb6f197de622e62668d2739a3570535a73eb2c36

    SHA512

    81d07be4b5fd38bf1497baf01fe118da5b2c539fb66bb400b807dab604dd2b18a6c1a9155419983e03c313e9ab08d85c686f38775bc1c6025d80670f67eb1a32

  • C:\Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    e58920dd254f0d469966b2d69a04bba3

    SHA1

    d6fcae3ed35cd9c2d63ab9ab8104565d7d61258b

    SHA256

    18a7829d04b836fbabb95b26eb6f197de622e62668d2739a3570535a73eb2c36

    SHA512

    81d07be4b5fd38bf1497baf01fe118da5b2c539fb66bb400b807dab604dd2b18a6c1a9155419983e03c313e9ab08d85c686f38775bc1c6025d80670f67eb1a32

  • C:\Temp\i_uelvflvcmw.exe

    Filesize

    361KB

    MD5

    538d84eda0508a2c8445ef5176587b9f

    SHA1

    ca2a1554b94c678f3d807f16445dbbc8f26df3e0

    SHA256

    62e98ed4a91aa6411ea0cff76d8f795be1454c4ec2380429fcf27bea0fdd1add

    SHA512

    d66e1a4be8d9825a90ddb9d30f113d437b0a92c43dd50fc81b135da25d7483766d7a8005531a637233c877524a254e0c4baa9b8d68915abc484447d4af480d45

  • C:\Temp\uelvflvcmw.exe

    Filesize

    361KB

    MD5

    5052efe40a1c954e84e9985072416163

    SHA1

    ce9aa76f84599d34456dec5ce0555159ded76a17

    SHA256

    61771a3aca5c9bef580d6e238dc2af31a4656a0b6c7fd2ff29060c670b193273

    SHA512

    c3bf51fe0c4fe45893ad20e2559d3860ffe4a80f7cd2598fa2add24e6a1fac07cc287f3de449cfd230850e6b87046e70ac52f82f171bc851fd45467f5e75b7df

  • C:\Temp\zspieyrnzvohextn.exe

    Filesize

    361KB

    MD5

    f26d188e0266ee725ffe77068f2303ca

    SHA1

    e4ca6f697596b04ed96700378e08a4b81e88e9e6

    SHA256

    bccc17055dace2d8ff0bdc68c9756181de702c35604a6fb27cd41e4eceb53951

    SHA512

    2207689e56af949b5ae1c830fb899cc511ef40aef3db8265105371bae0fa94043fa7af6eaafc9492fbc36e8a95c7198cacc00a76c20902581e474525998094b4

  • C:\Temp\zspieyrnzvohextn.exe

    Filesize

    361KB

    MD5

    f26d188e0266ee725ffe77068f2303ca

    SHA1

    e4ca6f697596b04ed96700378e08a4b81e88e9e6

    SHA256

    bccc17055dace2d8ff0bdc68c9756181de702c35604a6fb27cd41e4eceb53951

    SHA512

    2207689e56af949b5ae1c830fb899cc511ef40aef3db8265105371bae0fa94043fa7af6eaafc9492fbc36e8a95c7198cacc00a76c20902581e474525998094b4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FMH0R50L.txt

    Filesize

    601B

    MD5

    02e4eb43487b1b69bb093f57b7575677

    SHA1

    781ad4235696a723f3e21831bc7cc3761caf35ba

    SHA256

    581e85b906c00cee797622bef7cb08fc1d7871160b17a15e34267a576e176c5c

    SHA512

    3672f90ada2667de42030bd9a97428570c8f63cbda48fe2f07ef87e89b30462c6b997801e9d9d227df43f4499dd1165e2d2668e46a535a506a17d97a8556b1e3

  • C:\temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    e58920dd254f0d469966b2d69a04bba3

    SHA1

    d6fcae3ed35cd9c2d63ab9ab8104565d7d61258b

    SHA256

    18a7829d04b836fbabb95b26eb6f197de622e62668d2739a3570535a73eb2c36

    SHA512

    81d07be4b5fd38bf1497baf01fe118da5b2c539fb66bb400b807dab604dd2b18a6c1a9155419983e03c313e9ab08d85c686f38775bc1c6025d80670f67eb1a32

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    e58920dd254f0d469966b2d69a04bba3

    SHA1

    d6fcae3ed35cd9c2d63ab9ab8104565d7d61258b

    SHA256

    18a7829d04b836fbabb95b26eb6f197de622e62668d2739a3570535a73eb2c36

    SHA512

    81d07be4b5fd38bf1497baf01fe118da5b2c539fb66bb400b807dab604dd2b18a6c1a9155419983e03c313e9ab08d85c686f38775bc1c6025d80670f67eb1a32

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    e58920dd254f0d469966b2d69a04bba3

    SHA1

    d6fcae3ed35cd9c2d63ab9ab8104565d7d61258b

    SHA256

    18a7829d04b836fbabb95b26eb6f197de622e62668d2739a3570535a73eb2c36

    SHA512

    81d07be4b5fd38bf1497baf01fe118da5b2c539fb66bb400b807dab604dd2b18a6c1a9155419983e03c313e9ab08d85c686f38775bc1c6025d80670f67eb1a32

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    e58920dd254f0d469966b2d69a04bba3

    SHA1

    d6fcae3ed35cd9c2d63ab9ab8104565d7d61258b

    SHA256

    18a7829d04b836fbabb95b26eb6f197de622e62668d2739a3570535a73eb2c36

    SHA512

    81d07be4b5fd38bf1497baf01fe118da5b2c539fb66bb400b807dab604dd2b18a6c1a9155419983e03c313e9ab08d85c686f38775bc1c6025d80670f67eb1a32

  • \Temp\CreateProcess.exe

    Filesize

    3KB

    MD5

    e58920dd254f0d469966b2d69a04bba3

    SHA1

    d6fcae3ed35cd9c2d63ab9ab8104565d7d61258b

    SHA256

    18a7829d04b836fbabb95b26eb6f197de622e62668d2739a3570535a73eb2c36

    SHA512

    81d07be4b5fd38bf1497baf01fe118da5b2c539fb66bb400b807dab604dd2b18a6c1a9155419983e03c313e9ab08d85c686f38775bc1c6025d80670f67eb1a32

  • \Temp\zspieyrnzvohextn.exe

    Filesize

    361KB

    MD5

    f26d188e0266ee725ffe77068f2303ca

    SHA1

    e4ca6f697596b04ed96700378e08a4b81e88e9e6

    SHA256

    bccc17055dace2d8ff0bdc68c9756181de702c35604a6fb27cd41e4eceb53951

    SHA512

    2207689e56af949b5ae1c830fb899cc511ef40aef3db8265105371bae0fa94043fa7af6eaafc9492fbc36e8a95c7198cacc00a76c20902581e474525998094b4