Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

8

356418109b...86.exe

windows7-x64

8

356418109b...86.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    183s
  • max time network
    229s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 10:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    356418109b6500ee66960791ea8a5a9dd77ef1b3f4818d15d3684d2f796dab86.exe

  • Size

    1.1MB

  • MD5

    bf0f22c0a8be55c152da5c8b27a3041b

  • SHA1

    a7454adc9ca7dcd5b5b01d62f00528c4a7684f57

  • SHA256

    356418109b6500ee66960791ea8a5a9dd77ef1b3f4818d15d3684d2f796dab86

  • SHA512

    e4a931d956be9995fb622faaeebd898e3db68de5063b2996b0e6f520d207c42b1e95b7655bd2d1278a3a9eaf8482f7527e5d83297adcb6287c592e05b64f694d

  • SSDEEP

    24576:nNseVg7kAfPSoaLLt/9UrcoC+X3ZR+zU3MxN3/zzeBV2zzx:nNLVg9fq/JOch+X33+zU3MT/zze+zF

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
    stealer
  • Modifies registry class 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\356418109b6500ee66960791ea8a5a9dd77ef1b3f4818d15d3684d2f796dab86.exe
    "C:\Users\Admin\AppData\Local\Temp\356418109b6500ee66960791ea8a5a9dd77ef1b3f4818d15d3684d2f796dab86.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\temp\Setup.exe
      "C:\Windows\temp\Setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.2345.com/?8059
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1464
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:556
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Windows\temp\baieksjo.bat
        3⤵
          PID:340

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      61KB

      MD5

      fc4666cbca561e864e7fdf883a9e6661

      SHA1

      2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

      SHA256

      10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

      SHA512

      c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      57481b5090cd9913350a195273f1f729

      SHA1

      aae237c91dd00843c51ad48457fa5508d1a0750e

      SHA256

      8116d38599f64e6af2ab0d2f0e709394ad85c27287748c0e9b52d8a780c6f95b

      SHA512

      ba6574bb3e7d3af2d4aefc248a89121edf187ae9b1a34c34461830cc4caeeff108beee80b197f82bb5b33969d31a653427895a805465cae9898faf3e4c9dc8be

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t9o3c8r\imagestore.dat
      Filesize

      562B

      MD5

      d739ddbda1cbe88ec0d0008a9e358aea

      SHA1

      d678a6a455ad0b9131520edc2f2a978d6bc71d23

      SHA256

      945688a12575bb819928ae1923da1418dffc4eb1a04a51786634ce52ceb2314a

      SHA512

      ca57be2200c1a91e02012342f33d938c4998bfa1ae103bd0c9aa1e180ba96fdfbcf6ee118f870170f8a4e697cec3835d3ac80b3c5ee3f15e5ef712bec2f0ea9f

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9M92TKNZ.txt
      Filesize

      608B

      MD5

      d6c382e02638ed8748f77a2b237412da

      SHA1

      deddb991025127efe8946b661544a0e974ef4b2f

      SHA256

      d1fdfafdba510d659ea647347cb33111d80c24be7c031638f1d1b8a83503f86c

      SHA512

      5ed7ef52fab043fe42cc15777296eac5640cf5237f5591b82c596da80beb2293985be287c301c7126e6c80f69eddfc637d21565af202e40b642693d98f392edf

      Download Submit

    • C:\Windows\Temp\Setup.exe
      Filesize

      371KB

      MD5

      86726b83499bfe958ff83918bfb5e57d

      SHA1

      0fa513a2f7a0a97974b7161e0eb054447064b17d

      SHA256

      410e85778d9bc4b7f7e7f023913a92c75aceeb6e26769d4f11e33a9aef9998b2

      SHA512

      d91fb30bfc7d5d21cfce4388f0264ad131bba9e3ef30805364e01051686f5c472e8411dcdc3a564bc63e93bca636207a68212300bd32233f1d391dd4a4006cc5

      Download Submit

    • C:\Windows\temp\Setup.exe
      Filesize

      371KB

      MD5

      86726b83499bfe958ff83918bfb5e57d

      SHA1

      0fa513a2f7a0a97974b7161e0eb054447064b17d

      SHA256

      410e85778d9bc4b7f7e7f023913a92c75aceeb6e26769d4f11e33a9aef9998b2

      SHA512

      d91fb30bfc7d5d21cfce4388f0264ad131bba9e3ef30805364e01051686f5c472e8411dcdc3a564bc63e93bca636207a68212300bd32233f1d391dd4a4006cc5

      Download Submit

    • C:\Windows\temp\baieksjo.bat
      Filesize

      94B

      MD5

      71d9daa6586985cf41a7fd902c7c8a38

      SHA1

      fb6d18bebe05d5d2908c2b06b0b8e44f36002b14

      SHA256

      187e1de762626dde5c1ce86fddb6406f014cb75c4a2b6ebc1c9502145901dd7b

      SHA512

      619190d93532f50188aa4cccef481cdab2e3674a9a1dc9c68ffb56744d93e36cd508d5c6310b2f8adf96f8c5aebebb63ab345133b82e3ebe725f93a60a0e1481

      Download Submit

    • \Windows\Temp\Setup.exe
      Filesize

      371KB

      MD5

      86726b83499bfe958ff83918bfb5e57d

      SHA1

      0fa513a2f7a0a97974b7161e0eb054447064b17d

      SHA256

      410e85778d9bc4b7f7e7f023913a92c75aceeb6e26769d4f11e33a9aef9998b2

      SHA512

      d91fb30bfc7d5d21cfce4388f0264ad131bba9e3ef30805364e01051686f5c472e8411dcdc3a564bc63e93bca636207a68212300bd32233f1d391dd4a4006cc5

      Download Submit

    • \Windows\Temp\Setup.exe
      Filesize

      371KB

      MD5

      86726b83499bfe958ff83918bfb5e57d

      SHA1

      0fa513a2f7a0a97974b7161e0eb054447064b17d

      SHA256

      410e85778d9bc4b7f7e7f023913a92c75aceeb6e26769d4f11e33a9aef9998b2

      SHA512

      d91fb30bfc7d5d21cfce4388f0264ad131bba9e3ef30805364e01051686f5c472e8411dcdc3a564bc63e93bca636207a68212300bd32233f1d391dd4a4006cc5

      Download Submit

    • \Windows\Temp\Setup.exe
      Filesize

      371KB

      MD5

      86726b83499bfe958ff83918bfb5e57d

      SHA1

      0fa513a2f7a0a97974b7161e0eb054447064b17d

      SHA256

      410e85778d9bc4b7f7e7f023913a92c75aceeb6e26769d4f11e33a9aef9998b2

      SHA512

      d91fb30bfc7d5d21cfce4388f0264ad131bba9e3ef30805364e01051686f5c472e8411dcdc3a564bc63e93bca636207a68212300bd32233f1d391dd4a4006cc5

      Download Submit

    • \Windows\Temp\Setup.exe
      Filesize

      371KB

      MD5

      86726b83499bfe958ff83918bfb5e57d

      SHA1

      0fa513a2f7a0a97974b7161e0eb054447064b17d

      SHA256

      410e85778d9bc4b7f7e7f023913a92c75aceeb6e26769d4f11e33a9aef9998b2

      SHA512

      d91fb30bfc7d5d21cfce4388f0264ad131bba9e3ef30805364e01051686f5c472e8411dcdc3a564bc63e93bca636207a68212300bd32233f1d391dd4a4006cc5

      Download Submit

    • memory/1748-58-0x0000000000820000-0x0000000000843000-memory.dmp

      Filesize

      140KB

      Download

    • memory/1748-62-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

      Download

    • memory/1748-54-0x0000000075631000-0x0000000075633000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1748-57-0x0000000000820000-0x0000000000843000-memory.dmp

      Filesize

      140KB

      Download

    • memory/1748-56-0x0000000000820000-0x0000000000843000-memory.dmp

      Filesize

      140KB

      Download

    • memory/1748-55-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

      Download