Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/02/2023, 06:58
Static task
static1
Behavioral task
behavioral1
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Resource
win10v2004-20220812-en
General
-
Target
5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
-
Size
3.6MB
-
MD5
36fd273ea7607d3a203f257f4e2649ed
-
SHA1
5e243f79ecb539d0d1f75fce7ddfedeccee70a48
-
SHA256
471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
-
SHA512
cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
-
SSDEEP
98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
resource yara_rule behavioral1/memory/1108-66-0x0000000006450000-0x00000000067F0000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Executes dropped EXE 2 IoCs
pid Process 1452 voiceadequovl.exe 1108 voiceadequovl.exe -
Loads dropped DLL 4 IoCs
pid Process 1452 voiceadequovl.exe 1452 voiceadequovl.exe 1452 voiceadequovl.exe 1452 voiceadequovl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 892 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1108 voiceadequovl.exe Token: SeDebugPrivilege 892 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1452 1972 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1972 wrote to memory of 1452 1972 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1972 wrote to memory of 1452 1972 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1972 wrote to memory of 1452 1972 5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe 28 PID 1452 wrote to memory of 1108 1452 voiceadequovl.exe 29 PID 1452 wrote to memory of 1108 1452 voiceadequovl.exe 29 PID 1452 wrote to memory of 1108 1452 voiceadequovl.exe 29 PID 1452 wrote to memory of 1108 1452 voiceadequovl.exe 29 PID 1108 wrote to memory of 892 1108 voiceadequovl.exe 30 PID 1108 wrote to memory of 892 1108 voiceadequovl.exe 30 PID 1108 wrote to memory of 892 1108 voiceadequovl.exe 30 PID 1108 wrote to memory of 892 1108 voiceadequovl.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
365.5MB
MD5ba50f2bca86ba947a8d2035bb9b35123
SHA1a542b5c5d41174dc2475a219978123b7d14f958f
SHA25617790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5
SHA51208fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379
-
Filesize
196.1MB
MD52b3272a5a57adff7ae4882648c2552cf
SHA10f5db3c3a5e69493b002848cf8a7ed9fdfe713d9
SHA25680994dff9c8efb12e2dba3b9720f5d4ee425c093158bfa7d38f05590d7dee328
SHA512187ec45c9d1e30cb30a4185b3dc2e1a041b57eb468cee9b440fd0c2bf1ac3eb51abb67a005c56b4a42b70dc448bf8d0dc261ac26ab89c3796d77e5f760b05ded
-
Filesize
177.2MB
MD5623d94c304bca7fb16f44dcec4b2ef9c
SHA1107eb01604f8d5565632a369d084e741fddb4937
SHA256b2d768f223101703c4c7467e88d4397d1c3805d8da7bb45f64ae2d958115994b
SHA51242f1708b8b6598e3f603ec750b0a4cae9366eaf9b8fd3633bf759165304e905ddcdf6e0aa2b4512c50b9b667c71b0dc1c0e41f757825bda7517bdfd317f77207
-
Filesize
231.1MB
MD5cd68fc2a7272eafedca4434d67cdff5d
SHA18a1c9bbef029e2c8ea061db600d32773ea742941
SHA25666ae7bdf8386ce1fff1cf2e5f626852c44f32728517a2b13cfb2c3b24f5c99f2
SHA5129f3412889fbf3b67645e2a3cc44069340baebd4c936c472f123116d9cb86aa149d5ca7e533d5ede955ded7f8d1ee0f65d895e7da71c204d24cf6c682636bad7c
-
Filesize
222.6MB
MD5caf5bafdf0422d432fda72049d09df73
SHA1644040159226bbff60f5d748584e9d45a871a209
SHA256bf53bb348d1d9759e831fc7626781c365a111175203c3afd89b79130c81c9e6c
SHA512684804397c0454d5a83084e86102d78adfc5963e602368c53bb72cdfc568f746515f7f4c5c5b1600883116cd50ea920aa8bfe3e723d4953c8395b837011f24ba
-
Filesize
228.6MB
MD56bcb2b74b63fedd51b7437ee775480a0
SHA15e827cb85bd11cbd53046ec891b0626964bc6b25
SHA25698cd6f5f795a610a999dcfea5dab6be8061ea8b81cc59b2805a17e21159dda1e
SHA512d8855d973c671ca503174e80cd5dc39aa8cf0e45e6bec0ff2f7172535b3a794f14936a49422a60fd5c76547dfa820daf8122834fbbc025a737d7105201ce8237
-
Filesize
227.1MB
MD5a349e52b02efac0a1a99991b39ce49c7
SHA19ffa7bd39fc13a668212c8caca13b7de7c2b1e1c
SHA256f8904a6e15b1707e1c187b97acea3568abedd38be2b822600af703a48a4e700e
SHA5124b48e5528163555a941c65b8444d6dfd5ea546f854e8528347973dc959f17e221fee15c6c37c41986f750d652ebbae5601bfa0abfb8987c60704725c7369c7b3