Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    295s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    15/03/2023, 05:22

General

  • Target

    fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe

  • Size

    3.4MB

  • MD5

    c15dcae56336f681ea1dd5aad33bb62b

  • SHA1

    dec7bdfc4c06c2f1475e9159916da6fd05c7fc36

  • SHA256

    fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c

  • SHA512

    4e799450778e10b009e9e81771537b24d05a52cc6799ec869e46327f07b0d68acd478156c4370947aac11e55f69483f422c3f5a00baa878588001fe10c8e2e7b

  • SSDEEP

    49152:onrbOKMFrJmsf6/HAv4fVCnoYcNmCCyQaxfrLkWUhsZz2RNRenjqc4i3PHkVgXIf:YaEU6/HWQ4noYOCtapQX9ejqcT3/SgYf

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe
    "C:\Users\Admin\AppData\Local\Temp\fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\SysWOW64\icacls.exe
        "C:\Windows\System32\icacls.exe" "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
        3⤵
        • Modifies file permissions
        PID:1008
      • C:\Windows\SysWOW64\icacls.exe
        "C:\Windows\System32\icacls.exe" "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
        3⤵
        • Modifies file permissions
        PID:360
      • C:\Windows\SysWOW64\icacls.exe
        "C:\Windows\System32\icacls.exe" "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5" /inheritance:e /deny "admin:(R,REA,RA,RD)"
        3⤵
        • Modifies file permissions
        PID:1680
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /CREATE /TN "Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5" /TR "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe" /SC MINUTE
        3⤵
        • Creates scheduled task(s)
        PID:1372
      • C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe
        "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        PID:1768
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {7A6919CB-F91A-412E-AFC3-7DF02BFA5C3D} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:664
    • C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe
      C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      PID:1920

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe

    Filesize

    401.0MB

    MD5

    013d67893212171480ee0d0eb56e41a2

    SHA1

    b9ead447f8a2089dbf850eaf929006c80275bb59

    SHA256

    da6a6bb94e9bd2e48c199ef8fe0eeaab1e36baf88d266d75fee79ff810abff8c

    SHA512

    8c232108e90b08a1e1613f74c0223f1dd5cb459816acfa233ea88f3cc153d073db73966fb4b001625ea0d3e78a0116070485bbe95ef1bccf6ecc392708692cc8

  • C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe

    Filesize

    393.6MB

    MD5

    529784f9ad14b9710c379b2305547e91

    SHA1

    436d1244c51b25f5da5d1d0115c3aabe1f6dded6

    SHA256

    29cd18ad9b556b14685b197b67bc39f031ec243bba721948dce4be7a7cfba503

    SHA512

    e84aefb8b0f68a25749e1af3c5dc536e36da56c95d642cddbe1594cabd7b60536347c7de635bece671b201cabdd998924d8894a717ab4a6bf9a0ef2cfadde19a

  • C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe

    Filesize

    393.4MB

    MD5

    a51f7fba883b2dcd73255633644a95c6

    SHA1

    2fc70ce99a336eec8d304f47dd536dce047da894

    SHA256

    2a523bf1a396d1236d82783cf20d620db70c4edd9764f753faca35921f8e7cd1

    SHA512

    95f9942e3d0874ce74ccd4c239e8f92bc5260673d7a8b1c698961605ca910faa8d6c331c05f03daab4fa1472713ff15be5f0f29adcfc0703b45ea09675cb0761

  • C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe

    Filesize

    373.9MB

    MD5

    c5779b334346c1337b06433fe11f78fb

    SHA1

    40f22caa8903709c2d253acb9911a1bf3599925c

    SHA256

    db2e35527c6028a7190046312d5f423e405e2eddc29e9d519e780106e86b9976

    SHA512

    cc25ae1c89dd71afddc6c31b2317a38b69df89a6f25e7fa4e93f1c8a431ac4c1b43997884cfb551035f68122ad2c037cb3db4b5ac0f2de5b883db73e79a3d077

  • \ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe

    Filesize

    397.1MB

    MD5

    e99292e555c22e43cbdaab0d338f4e9e

    SHA1

    bded8fb3aa460216ad816d4f945d74b67a945b23

    SHA256

    33b3ffda85cfb00723e5491f882a203c143a438f5e30d6942fd8068895354a24

    SHA512

    7731054b8e39061185734512590b93ffed08b0e5b71152010aca45ee78f4d8efd3ee68fe00e747761730fa1695b1d5f44ef288b9fbccedea8daea64f201d5006

  • \ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe

    Filesize

    398.5MB

    MD5

    f9100b7a5b007e986c330af94c7f4357

    SHA1

    b42dc015c4686633f07293d174c12305484772c5

    SHA256

    b83913229ae7e3caddfc07019b37c049d9e9f2b99a54e14aa5f137daa5fe69b8

    SHA512

    d8c1c0e02b167f950fe39722929fd0d120bed6bab33b761ed6cac9864c771d5a6e873b36606fe60d1d0687a8c10310d43a698e48ce4a73d88119221c44c20bb1

  • \ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe

    Filesize

    371.9MB

    MD5

    bdcda7c2e3f3b8bbf7e1262008f98614

    SHA1

    6caea51327f57ac17b3f5fab2fe749eee141ffe0

    SHA256

    1e80248fef6ed8fc5da9463c08723645c8e9488c346c6999053b963eba5c99ab

    SHA512

    05e255be586073b95bd02ea44fcf1b3f2dbeb1a0532429d39c145baefba381e6df042096c22e7fd7bfa3e7179c4c6bb57bfc9a0326db3c40324dbaef07b55cab

  • \ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe

    Filesize

    378.6MB

    MD5

    aea814292d14ff50ae6a67089d9c143a

    SHA1

    43f2b980c557dfc1d26516e2914fc560cf43d3cc

    SHA256

    7f1afffdb1410ab85aa383bdfeb51789d775a2cb79fa659af40ca3868ff3c13e

    SHA512

    9832527d2d07f8ad67e8876fa8c163e60f219dae42d00e9652afef35c57eeac0d00de862cf22bb08c31f419bd07f32b511b0242c9755e7b04eb572332cfdc56a

  • memory/664-94-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/664-87-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/664-86-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/1768-78-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/1768-88-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/1768-80-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/1768-81-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/1768-82-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/1920-89-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/1920-90-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/1920-91-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/1920-92-0x000000013FED0000-0x00000001403EF000-memory.dmp

    Filesize

    5.1MB

  • memory/1984-66-0x0000000005240000-0x0000000005280000-memory.dmp

    Filesize

    256KB

  • memory/1984-77-0x0000000008700000-0x0000000008C1F000-memory.dmp

    Filesize

    5.1MB

  • memory/1984-76-0x0000000008700000-0x0000000008C1F000-memory.dmp

    Filesize

    5.1MB

  • memory/1984-67-0x0000000005240000-0x0000000005280000-memory.dmp

    Filesize

    256KB

  • memory/1984-55-0x0000000000400000-0x000000000075C000-memory.dmp

    Filesize

    3.4MB

  • memory/1984-65-0x0000000005240000-0x0000000005280000-memory.dmp

    Filesize

    256KB

  • memory/1984-64-0x0000000005240000-0x0000000005280000-memory.dmp

    Filesize

    256KB

  • memory/1984-63-0x0000000000400000-0x000000000075C000-memory.dmp

    Filesize

    3.4MB

  • memory/1984-62-0x0000000000400000-0x000000000075C000-memory.dmp

    Filesize

    3.4MB

  • memory/1984-60-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/1984-56-0x0000000000400000-0x000000000075C000-memory.dmp

    Filesize

    3.4MB