Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    70s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/04/2023, 17:38

General

  • Target

    FE TEXT TO SPEECH - Linkvertise Downloader_UhJyR-1.exe

  • Size

    10.8MB

  • MD5

    9ef88d8681a8606d5572078acfef47d5

  • SHA1

    7d78745444359b634c1fd8f0c4f5bcc11a601daf

  • SHA256

    7d0f7d4dd28130bf130a16fc125a37e7fa4f56900fad7f02fadcf609788d1948

  • SHA512

    f9106049cf41fe67f1e97f1eb12bbb4a3c4dfc72252893aca3413c305ee62210b416d1ad160bf0c9b9a1313e404a406e400f74d3d49b13c0d0d5d363b8cc0ba5

  • SSDEEP

    196608:R38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ughp71:21MlCC0Ybzf4zZKUok5oXN8i1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FE TEXT TO SPEECH - Linkvertise Downloader_UhJyR-1.exe
    "C:\Users\Admin\AppData\Local\Temp\FE TEXT TO SPEECH - Linkvertise Downloader_UhJyR-1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\is-A5O95.tmp\FE TEXT TO SPEECH - Linkvertise Downloader_UhJyR-1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-A5O95.tmp\FE TEXT TO SPEECH - Linkvertise Downloader_UhJyR-1.tmp" /SL5="$70124,10376221,1235456,C:\Users\Admin\AppData\Local\Temp\FE TEXT TO SPEECH - Linkvertise Downloader_UhJyR-1.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1936

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    e71c8443ae0bc2e282c73faead0a6dd3

    SHA1

    0c110c1b01e68edfacaeae64781a37b1995fa94b

    SHA256

    95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

    SHA512

    b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    097b11fba1ea18b3bf02c9d60677f0c9

    SHA1

    23611f0afccbd2f32361f4d2071e036d9da10a65

    SHA256

    f9434f27ff9446e18e674e21a7398e8dbcc39238fc4459ee1d580de1101e2068

    SHA512

    7a8a426cad0a347ed6e57b4790ffec7542ab33a685d89296deaa1373e0ff52ff31e9afad88f9c2c65db46f2c8f2d83c2f39638e3e6d2dfb34954b0a09e7c37d1

  • C:\Users\Admin\AppData\Local\Temp\Tar33D5.tmp

    Filesize

    161KB

    MD5

    be2bec6e8c5653136d3e72fe53c98aa3

    SHA1

    a8182d6db17c14671c3d5766c72e58d87c0810de

    SHA256

    1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

    SHA512

    0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

  • C:\Users\Admin\AppData\Local\Temp\is-A5O95.tmp\FE TEXT TO SPEECH - Linkvertise Downloader_UhJyR-1.tmp

    Filesize

    3.4MB

    MD5

    fbbad8149a1c6aed741101d3011757cb

    SHA1

    badef69a28b857fdd0b9859552736faba9e8886a

    SHA256

    d5f92ec4e4f095bea8fb56825333eaa6c3fb5e3b2dfc245bac058cdfb6cef4b8

    SHA512

    edc6d6cba79cc6d595cdc72f448189e9d5f5b0208c09bbfdd6344cd029848ec155e5aa744eac437a13f14f61b0297308b36df90b190a138e4c34aa8bb45d3b42

  • C:\Users\Admin\AppData\Local\Temp\is-JJR4C.tmp\side-logo.png

    Filesize

    29KB

    MD5

    06b0076d9f4e2488d32855a0161e9c74

    SHA1

    7dbc3c098f7fb1256aeca79c256b75802b5fdd69

    SHA256

    929243f002eb4209a9e68af6744a3d63ece2b173c910a59d6752536dabf3870b

    SHA512

    7cecc1fc1c13f97dfe1ae7592918c9df16233851a8dd667ac2199b92fd24410a6ef76acfa014cd00aad2d27dfe2887f41100563cf2240f720466dbebaed0375a

  • \Users\Admin\AppData\Local\Temp\is-A5O95.tmp\FE TEXT TO SPEECH - Linkvertise Downloader_UhJyR-1.tmp

    Filesize

    3.4MB

    MD5

    fbbad8149a1c6aed741101d3011757cb

    SHA1

    badef69a28b857fdd0b9859552736faba9e8886a

    SHA256

    d5f92ec4e4f095bea8fb56825333eaa6c3fb5e3b2dfc245bac058cdfb6cef4b8

    SHA512

    edc6d6cba79cc6d595cdc72f448189e9d5f5b0208c09bbfdd6344cd029848ec155e5aa744eac437a13f14f61b0297308b36df90b190a138e4c34aa8bb45d3b42

  • \Users\Admin\AppData\Local\Temp\is-JJR4C.tmp\AppUtils.dll

    Filesize

    1.8MB

    MD5

    43ce6d593abd5141a3139603f352ae05

    SHA1

    a97c75e23d275dddfde15ef5fdf3ff3253c0992c

    SHA256

    94e874f2702ea6be50e7d74864b66e7f763449c3db237803f3fad6adfd64ed3d

    SHA512

    bfc527529e5f73ba190dfc5bd043175c7e2ae963b665d6d39421c29e025020f1d593dc88b7bee33d86ef6b4f7a4c5e1a0339df4e99cab6849a275d1dda9f439f

  • \Users\Admin\AppData\Local\Temp\is-JJR4C.tmp\botva2.dll

    Filesize

    37KB

    MD5

    67965a5957a61867d661f05ae1f4773e

    SHA1

    f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

    SHA256

    450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

    SHA512

    c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

  • memory/1936-61-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1936-199-0x0000000003770000-0x000000000377F000-memory.dmp

    Filesize

    60KB

  • memory/1936-206-0x0000000000400000-0x0000000000775000-memory.dmp

    Filesize

    3.5MB

  • memory/1936-207-0x0000000003770000-0x000000000377F000-memory.dmp

    Filesize

    60KB

  • memory/1936-208-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1960-54-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB

  • memory/1960-205-0x0000000000400000-0x000000000053B000-memory.dmp

    Filesize

    1.2MB