Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    12/04/2023, 07:50

General

  • Target

    4c3499f3cc4a4fdc7e67417e055891c78540282dccc57e37a01167dfe351b244.dll

  • Size

    453KB

  • MD5

    56018500f73e3f6cf179d3b853c27912

  • SHA1

    a3060a3efb9ac3da444ef8abc99143293076fe32

  • SHA256

    4c3499f3cc4a4fdc7e67417e055891c78540282dccc57e37a01167dfe351b244

  • SHA512

    730586717c13d19c4141ce1b44a6e91bcfe4deac8c99eb438d452c965c0b5adac4b2b68da04ad6abc6900bcc410d1801e448831903a8265f3b370896434d8f8e

  • SSDEEP

    12288:BJWFxerI6z4GrTyPy2ROqz/sC670ahgA6:BJWuIE4Gr2PX5UCs0a

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4c3499f3cc4a4fdc7e67417e055891c78540282dccc57e37a01167dfe351b244.dll,CMS_dataFinal Bx9yb37GEcJNK6bt 4901
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Windows\System32\rundll32.exe
      C:\\Windows\\System32\\rundll32.exe C:\\ProgramData\\VMware\\vmnat-update.bin,OCSP_resp_find lxUi5CZ0IV45j89Y 4901
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Modifies system certificate store
      PID:1680

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\VMware\vmnat-update.bin

    Filesize

    512KB

    MD5

    f5475608c0126582081e29927424f338

    SHA1

    8e88fd82378794a17a4211fbf2ee2506b9636b02

    SHA256

    a75886b016d84c3eaacaf01a3c61e04953a7a3adf38acf77a4a2e3a8f544f855

    SHA512

    b47eb6b6d22ce249a8661daf576af2fcc4d5eeae78a48ff1fda4bc4816b7b4d12c40211b716cec372f7b7b5bd4878efa1a9cf7e54dbbf6cb878065abb0d4e05a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    e71c8443ae0bc2e282c73faead0a6dd3

    SHA1

    0c110c1b01e68edfacaeae64781a37b1995fa94b

    SHA256

    95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

    SHA512

    b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7e0d007a09ca53a98d97c73e35349f87

    SHA1

    91cddda8fc2ace702b70015666e528802f61a09c

    SHA256

    5246326a5d3c5338226c85b21295a6ae3fdbacc1ed903de731c76492b70b580b

    SHA512

    1dc8b420cde313521c447d44ba6b8b854234ec40d1979c9260d97bd1f2312609ec21321d43a4371c637c34e53a8cba4fbc57664305824fcd0482e4c567cf2aa9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f599ff82cec9b8e297b0fa1843ebb59b

    SHA1

    33665565482fc5a47465d39a8e62c8ebeb7a163e

    SHA256

    b5b9332cd373d255a2b4fefa8405009a4a89361e88c9a1c0db20622ac0a75dd1

    SHA512

    36fa3b3ae6a67af3c4bfdae49507ce667f965cebfd2f185560dbc66cf9643df8f1f330b118cc202f06dc7e4fb77d3e05a08d5c7e18c22834c55db70b7217a260

  • C:\Users\Admin\AppData\Local\Temp\Tar179E.tmp

    Filesize

    161KB

    MD5

    be2bec6e8c5653136d3e72fe53c98aa3

    SHA1

    a8182d6db17c14671c3d5766c72e58d87c0810de

    SHA256

    1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

    SHA512

    0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

  • \ProgramData\VMware\vmnat-update.bin

    Filesize

    512KB

    MD5

    f5475608c0126582081e29927424f338

    SHA1

    8e88fd82378794a17a4211fbf2ee2506b9636b02

    SHA256

    a75886b016d84c3eaacaf01a3c61e04953a7a3adf38acf77a4a2e3a8f544f855

    SHA512

    b47eb6b6d22ce249a8661daf576af2fcc4d5eeae78a48ff1fda4bc4816b7b4d12c40211b716cec372f7b7b5bd4878efa1a9cf7e54dbbf6cb878065abb0d4e05a

  • memory/1680-57-0x0000000180000000-0x00000001800AF000-memory.dmp

    Filesize

    700KB