Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    20s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2023, 02:38

General

  • Target

    27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe

  • Size

    3.8MB

  • MD5

    bb822e95e45231a03a063a791d66df2b

  • SHA1

    4a6d37d130631be7e24a28d618d30de48d7aa042

  • SHA256

    27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257

  • SHA512

    8fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1

  • SSDEEP

    98304:mnsmtk2anG8nAiYW1xjfAVXCnXrDgInJBNV/:YLcggoVXiXtJBNV/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe
    "C:\Users\Admin\AppData\Local\Temp\27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\._cache_27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe"
      2⤵
      • Executes dropped EXE
      PID:1156
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1488
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        PID:1132
  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:884

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    3.8MB

    MD5

    bb822e95e45231a03a063a791d66df2b

    SHA1

    4a6d37d130631be7e24a28d618d30de48d7aa042

    SHA256

    27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257

    SHA512

    8fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    3.8MB

    MD5

    bb822e95e45231a03a063a791d66df2b

    SHA1

    4a6d37d130631be7e24a28d618d30de48d7aa042

    SHA256

    27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257

    SHA512

    8fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    3.8MB

    MD5

    bb822e95e45231a03a063a791d66df2b

    SHA1

    4a6d37d130631be7e24a28d618d30de48d7aa042

    SHA256

    27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257

    SHA512

    8fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1

  • C:\Users\Admin\AppData\Local\Temp\._cache_27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe

    Filesize

    3.0MB

    MD5

    674c64a7e4fa94893123da22f8ea30af

    SHA1

    2456068eae785cd2cd70990b61a36c3f999ca0a2

    SHA256

    252f7ce9ebbeb17218d390a322720c04a41c4f4186982472e4885a26dfeef709

    SHA512

    6033ec982c889106d2d765a7227610b478e28620228afeadd3b965724e5e8e87af86de2ab3ab219a98b32ad25fb34f72edcb6b87e4ef06d4a86d1cd823bb190c

  • C:\Users\Admin\AppData\Local\Temp\._cache_27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe

    Filesize

    3.0MB

    MD5

    674c64a7e4fa94893123da22f8ea30af

    SHA1

    2456068eae785cd2cd70990b61a36c3f999ca0a2

    SHA256

    252f7ce9ebbeb17218d390a322720c04a41c4f4186982472e4885a26dfeef709

    SHA512

    6033ec982c889106d2d765a7227610b478e28620228afeadd3b965724e5e8e87af86de2ab3ab219a98b32ad25fb34f72edcb6b87e4ef06d4a86d1cd823bb190c

  • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

    Filesize

    3.0MB

    MD5

    674c64a7e4fa94893123da22f8ea30af

    SHA1

    2456068eae785cd2cd70990b61a36c3f999ca0a2

    SHA256

    252f7ce9ebbeb17218d390a322720c04a41c4f4186982472e4885a26dfeef709

    SHA512

    6033ec982c889106d2d765a7227610b478e28620228afeadd3b965724e5e8e87af86de2ab3ab219a98b32ad25fb34f72edcb6b87e4ef06d4a86d1cd823bb190c

  • C:\Users\Admin\AppData\Local\Temp\EiyGtTYm.xlsm

    Filesize

    17KB

    MD5

    e566fc53051035e1e6fd0ed1823de0f9

    SHA1

    00bc96c48b98676ecd67e81a6f1d7754e4156044

    SHA256

    8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

    SHA512

    a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

  • \ProgramData\Synaptics\Synaptics.exe

    Filesize

    3.8MB

    MD5

    bb822e95e45231a03a063a791d66df2b

    SHA1

    4a6d37d130631be7e24a28d618d30de48d7aa042

    SHA256

    27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257

    SHA512

    8fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1

  • \ProgramData\Synaptics\Synaptics.exe

    Filesize

    3.8MB

    MD5

    bb822e95e45231a03a063a791d66df2b

    SHA1

    4a6d37d130631be7e24a28d618d30de48d7aa042

    SHA256

    27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257

    SHA512

    8fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1

  • \ProgramData\Synaptics\Synaptics.exe

    Filesize

    3.8MB

    MD5

    bb822e95e45231a03a063a791d66df2b

    SHA1

    4a6d37d130631be7e24a28d618d30de48d7aa042

    SHA256

    27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257

    SHA512

    8fb86d9b49db91e26678084c266e95039f1dfe0c9ff0d5dff5f4fd7baeb09e9cf4ef8c46d407cdb6fb1ce409d35f0fac252c8ab70cdd4f46d9b6732531b395e1

  • \Users\Admin\AppData\Local\Temp\._cache_27d3c4f58b48471511fd2597f39987384f76b3113ea5df3a94c55ffe340ea257.exe

    Filesize

    3.0MB

    MD5

    674c64a7e4fa94893123da22f8ea30af

    SHA1

    2456068eae785cd2cd70990b61a36c3f999ca0a2

    SHA256

    252f7ce9ebbeb17218d390a322720c04a41c4f4186982472e4885a26dfeef709

    SHA512

    6033ec982c889106d2d765a7227610b478e28620228afeadd3b965724e5e8e87af86de2ab3ab219a98b32ad25fb34f72edcb6b87e4ef06d4a86d1cd823bb190c

  • \Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

    Filesize

    3.0MB

    MD5

    674c64a7e4fa94893123da22f8ea30af

    SHA1

    2456068eae785cd2cd70990b61a36c3f999ca0a2

    SHA256

    252f7ce9ebbeb17218d390a322720c04a41c4f4186982472e4885a26dfeef709

    SHA512

    6033ec982c889106d2d765a7227610b478e28620228afeadd3b965724e5e8e87af86de2ab3ab219a98b32ad25fb34f72edcb6b87e4ef06d4a86d1cd823bb190c

  • memory/884-733-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/884-727-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/884-707-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/884-724-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/884-721-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/884-718-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/884-715-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/884-713-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/884-710-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/884-478-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/884-730-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/884-702-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/884-704-0x00000000003C0000-0x00000000004C0000-memory.dmp

    Filesize

    1024KB

  • memory/1132-938-0x00000000025D0000-0x00000000026E1000-memory.dmp

    Filesize

    1.1MB

  • memory/1132-931-0x00000000025D0000-0x00000000026E1000-memory.dmp

    Filesize

    1.1MB

  • memory/1132-110-0x0000000075C30000-0x0000000075C77000-memory.dmp

    Filesize

    284KB

  • memory/1132-5669-0x0000000000400000-0x000000000087F000-memory.dmp

    Filesize

    4.5MB

  • memory/1132-97-0x0000000000400000-0x000000000087F000-memory.dmp

    Filesize

    4.5MB

  • memory/1132-3445-0x00000000021E0000-0x00000000022E0000-memory.dmp

    Filesize

    1024KB

  • memory/1132-2758-0x0000000002320000-0x00000000024A1000-memory.dmp

    Filesize

    1.5MB

  • memory/1132-2755-0x00000000021E0000-0x00000000022E0000-memory.dmp

    Filesize

    1024KB

  • memory/1132-943-0x00000000025D0000-0x00000000026E1000-memory.dmp

    Filesize

    1.1MB

  • memory/1132-945-0x00000000025D0000-0x00000000026E1000-memory.dmp

    Filesize

    1.1MB

  • memory/1132-933-0x00000000025D0000-0x00000000026E1000-memory.dmp

    Filesize

    1.1MB

  • memory/1132-936-0x00000000025D0000-0x00000000026E1000-memory.dmp

    Filesize

    1.1MB

  • memory/1132-930-0x00000000025D0000-0x00000000026E1000-memory.dmp

    Filesize

    1.1MB

  • memory/1132-941-0x00000000025D0000-0x00000000026E1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-965-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-959-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-934-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-939-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-929-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-940-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-5588-0x0000000000400000-0x000000000087F000-memory.dmp

    Filesize

    4.5MB

  • memory/1156-937-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-927-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-935-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-3290-0x0000000002080000-0x0000000002180000-memory.dmp

    Filesize

    1024KB

  • memory/1156-973-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-972-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-971-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-970-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-969-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-968-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-967-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-966-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-91-0x0000000075C30000-0x0000000075C77000-memory.dmp

    Filesize

    284KB

  • memory/1156-964-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-963-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-962-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-961-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-960-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-932-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-958-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-957-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-956-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-955-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-954-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-953-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-952-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-951-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-950-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-949-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-948-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-947-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-946-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-2615-0x0000000002210000-0x0000000002391000-memory.dmp

    Filesize

    1.5MB

  • memory/1156-944-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-72-0x0000000000400000-0x000000000087F000-memory.dmp

    Filesize

    4.5MB

  • memory/1156-942-0x00000000024C0000-0x00000000025D1000-memory.dmp

    Filesize

    1.1MB

  • memory/1156-2613-0x0000000002080000-0x0000000002180000-memory.dmp

    Filesize

    1024KB

  • memory/1488-435-0x0000000000400000-0x00000000007C7000-memory.dmp

    Filesize

    3.8MB

  • memory/1488-847-0x0000000000400000-0x00000000007C7000-memory.dmp

    Filesize

    3.8MB

  • memory/1488-93-0x0000000005060000-0x00000000054DF000-memory.dmp

    Filesize

    4.5MB

  • memory/1488-5665-0x0000000005060000-0x00000000054DF000-memory.dmp

    Filesize

    4.5MB

  • memory/1488-99-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1520-71-0x00000000053E0000-0x000000000585F000-memory.dmp

    Filesize

    4.5MB

  • memory/1520-81-0x0000000000400000-0x00000000007C7000-memory.dmp

    Filesize

    3.8MB

  • memory/1520-64-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB