Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/02/2023, 01:13
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20221111-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
resource yara_rule behavioral1/memory/1756-66-0x0000000006450000-0x00000000067F0000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 2 IoCs
pid Process 896 voiceadequovl.exe 1756 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
pid Process 896 voiceadequovl.exe 896 voiceadequovl.exe 896 voiceadequovl.exe 896 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1964 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1756 voiceadequovl.exe Token: SeDebugPrivilege 1964 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 856 wrote to memory of 896 856 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 27 PID 856 wrote to memory of 896 856 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 27 PID 856 wrote to memory of 896 856 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 27 PID 856 wrote to memory of 896 856 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 27 PID 896 wrote to memory of 1756 896 voiceadequovl.exe 28 PID 896 wrote to memory of 1756 896 voiceadequovl.exe 28 PID 896 wrote to memory of 1756 896 voiceadequovl.exe 28 PID 896 wrote to memory of 1756 896 voiceadequovl.exe 28 PID 1756 wrote to memory of 1964 1756 voiceadequovl.exe 29 PID 1756 wrote to memory of 1964 1756 voiceadequovl.exe 29 PID 1756 wrote to memory of 1964 1756 voiceadequovl.exe 29 PID 1756 wrote to memory of 1964 1756 voiceadequovl.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
222.0MB
MD5dee03006815a9ba6269bec665ff8dfeb
SHA1f19bb01a6774699574105a8402bfc38c9f5aafc5
SHA25611569a215faa3caa27bd61eddb56f89ec05d87795dd033054ff4787780c25675
SHA512d3322f31c3f340a04c7a388d69c579c266a583fa1edfc7920ddce1efe2e09f45ba8be7eb815c7a55431cf434223e9d802bd7bcaf548cb432a6cb34c45926fbee
-
Filesize
211.8MB
MD59ed9651d012f3848dbdb36caf1be23e7
SHA1940bd78348e453bdf0a56c8fbdb17e3d5365a526
SHA256d09f066049fd3414c578612d7a41c7cba3be38d41ec250eb17644b36043b1d02
SHA512d9e1fb6ca800203c7a53d9a28c146dabcd14d02fad97427d22ac002cc413bd84b487ad6793275567c5427fb5a85fae1211d6e2e7951decb5099d163db3ac1eb5
-
Filesize
187.3MB
MD5f98392363e9e140573229440922e9941
SHA12434cf3818b1e2fd8ae7fcff1126e7f1a38e0b33
SHA25619e5ef1b5c35edb5dc66281a4ea11a02c4ace9bd1df1130cec97988fd056e29d
SHA51240140b4a5f7d27c6fcf4b60b884f229b75f16eb100a51c8e0af955267f72fa4d6b0c13b372cbc39231bf58e6b13957d10f03b17b47bb7fa89dddc5e88bb07373
-
Filesize
228.6MB
MD56bcb2b74b63fedd51b7437ee775480a0
SHA15e827cb85bd11cbd53046ec891b0626964bc6b25
SHA25698cd6f5f795a610a999dcfea5dab6be8061ea8b81cc59b2805a17e21159dda1e
SHA512d8855d973c671ca503174e80cd5dc39aa8cf0e45e6bec0ff2f7172535b3a794f14936a49422a60fd5c76547dfa820daf8122834fbbc025a737d7105201ce8237
-
Filesize
229.0MB
MD51058e6af7a12002968fe963af446b012
SHA1e27121c5e338d09810db67bc318ee26eb6f3bd07
SHA256c2b2d41f8dc1e9e3be9f8fc506c86fe3bac716896434788c789d3dfb064b7f09
SHA512d8f758ac9b5e4b0b52a79f1e8e1b76d67f3417a3341cc5511b714a5269158ce8ad049e4372a15329ba1e4a8ad10aa533b3a1fadf7574815d7a8623fdb2d3bb11
-
Filesize
231.1MB
MD5cd68fc2a7272eafedca4434d67cdff5d
SHA18a1c9bbef029e2c8ea061db600d32773ea742941
SHA25666ae7bdf8386ce1fff1cf2e5f626852c44f32728517a2b13cfb2c3b24f5c99f2
SHA5129f3412889fbf3b67645e2a3cc44069340baebd4c936c472f123116d9cb86aa149d5ca7e533d5ede955ded7f8d1ee0f65d895e7da71c204d24cf6c682636bad7c