Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 14:49

General

  • Target

    fd7e187e518df255ce5c1d37ae7eec5e7a2e7a2abc8943eed9dd7a99b6b622b3.exe

  • Size

    35KB

  • MD5

    8efa1c33b6d16563c499807baa39a958

  • SHA1

    2520666dc9b51d0e5c5e27454a3824348c2512d8

  • SHA256

    fd7e187e518df255ce5c1d37ae7eec5e7a2e7a2abc8943eed9dd7a99b6b622b3

  • SHA512

    8b9f827a64abf828ac5d3b85c5bac3a74ac70e3d2e7485d5c68023847cc6243ff16f672612c950b3cd4bbc318e9ed87c78a8e1787379dd57df9fb08e2b6c7489

  • SSDEEP

    384:x9RlQG13BLgexxxaR0O834rfmAT/5bcicoAVmaqsj7T0oY7cQ67oJk1Ziwf6hyc3:TQGpmes+olciha/sw8cF6srxLwN97jB

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd7e187e518df255ce5c1d37ae7eec5e7a2e7a2abc8943eed9dd7a99b6b622b3.exe
    "C:\Users\Admin\AppData\Local\Temp\fd7e187e518df255ce5c1d37ae7eec5e7a2e7a2abc8943eed9dd7a99b6b622b3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Users\Admin\AppData\Local\Temp\fd7e187e518df255ce5c1d37ae7eec5e7a2e7a2abc8943eed9dd7a99b6b622b3.exe
      "C:\Users\Admin\AppData\Local\Temp\fd7e187e518df255ce5c1d37ae7eec5e7a2e7a2abc8943eed9dd7a99b6b622b3.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1460
      • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\fd7e187e518df255ce5c1d37ae7eec5e7a2e7a2abc8943eed9dd7a99b6b622b3.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
          "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\fd7e187e518df255ce5c1d37ae7eec5e7a2e7a2abc8943eed9dd7a99b6b622b3.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1888
          • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
            "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\fd7e187e518df255ce5c1d37ae7eec5e7a2e7a2abc8943eed9dd7a99b6b622b3.exe
            5⤵
              PID:1844

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

      Filesize

      35KB

      MD5

      a36d8eb7e827eef145977e7b5ade9d3a

      SHA1

      23a308a9aa531752a23dc9ef9573e34957a71e0e

      SHA256

      e567d736fd11ad28cd3fb7edf38b359a4d4904739b68e6b67535a470cf8eed0a

      SHA512

      d9c35993798ebbb8c7574dd84000f836734daba6c14d27018fdfe1f91fd6de521aef7e10250c8fd1df6d670db305a6078700110032b83c246e86b0e3b2363e2f

    • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

      Filesize

      35KB

      MD5

      a36d8eb7e827eef145977e7b5ade9d3a

      SHA1

      23a308a9aa531752a23dc9ef9573e34957a71e0e

      SHA256

      e567d736fd11ad28cd3fb7edf38b359a4d4904739b68e6b67535a470cf8eed0a

      SHA512

      d9c35993798ebbb8c7574dd84000f836734daba6c14d27018fdfe1f91fd6de521aef7e10250c8fd1df6d670db305a6078700110032b83c246e86b0e3b2363e2f

    • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

      Filesize

      35KB

      MD5

      a36d8eb7e827eef145977e7b5ade9d3a

      SHA1

      23a308a9aa531752a23dc9ef9573e34957a71e0e

      SHA256

      e567d736fd11ad28cd3fb7edf38b359a4d4904739b68e6b67535a470cf8eed0a

      SHA512

      d9c35993798ebbb8c7574dd84000f836734daba6c14d27018fdfe1f91fd6de521aef7e10250c8fd1df6d670db305a6078700110032b83c246e86b0e3b2363e2f

    • \Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

      Filesize

      35KB

      MD5

      a36d8eb7e827eef145977e7b5ade9d3a

      SHA1

      23a308a9aa531752a23dc9ef9573e34957a71e0e

      SHA256

      e567d736fd11ad28cd3fb7edf38b359a4d4904739b68e6b67535a470cf8eed0a

      SHA512

      d9c35993798ebbb8c7574dd84000f836734daba6c14d27018fdfe1f91fd6de521aef7e10250c8fd1df6d670db305a6078700110032b83c246e86b0e3b2363e2f

    • \Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

      Filesize

      35KB

      MD5

      a36d8eb7e827eef145977e7b5ade9d3a

      SHA1

      23a308a9aa531752a23dc9ef9573e34957a71e0e

      SHA256

      e567d736fd11ad28cd3fb7edf38b359a4d4904739b68e6b67535a470cf8eed0a

      SHA512

      d9c35993798ebbb8c7574dd84000f836734daba6c14d27018fdfe1f91fd6de521aef7e10250c8fd1df6d670db305a6078700110032b83c246e86b0e3b2363e2f

    • memory/1460-58-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1460-64-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1460-65-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1460-60-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1460-54-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1460-59-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1460-63-0x0000000075981000-0x0000000075983000-memory.dmp

      Filesize

      8KB

    • memory/1460-57-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1460-84-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1460-55-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1888-83-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1888-85-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1888-88-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB