Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    77s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    19/05/2023, 18:12

General

  • Target

    clipx-1.0.3.8-installer_CYph-n1.exe

  • Size

    1.7MB

  • MD5

    5e490e1188b03b411e941b88be7388e0

  • SHA1

    9767343dcc68a8d2c591a648f452593c2cc1bd0f

  • SHA256

    c484600d6a850d0e45cc5b17bb5cd9ed9b95245aa707f2c0001d107411e248de

  • SHA512

    e29e0aefc31ee1e706301d5ba21772358644888b51643dc69457696beff0ae0da71905610a3a8aebdf1289fc98ecb74fc0d71baa06948a62216e2b434c4af12e

  • SSDEEP

    24576:27FUDowAyrTVE3U5FmzVRKuPaJPfrT90eKc4cgFLNPfs8duMpmsDq:2BuZrEUgRKuwPH9RHgFLRdp/O

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\clipx-1.0.3.8-installer_CYph-n1.exe
    "C:\Users\Admin\AppData\Local\Temp\clipx-1.0.3.8-installer_CYph-n1.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Users\Admin\AppData\Local\Temp\is-SSTEH.tmp\clipx-1.0.3.8-installer_CYph-n1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-SSTEH.tmp\clipx-1.0.3.8-installer_CYph-n1.tmp" /SL5="$70122,875199,832512,C:\Users\Admin\AppData\Local\Temp\clipx-1.0.3.8-installer_CYph-n1.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1692

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    027679d5ac65d28b5eebac83ff947f37

    SHA1

    bec05f9653cca84ab42a90ffa5465c39f734d2bf

    SHA256

    6f7c61348f0285d885be39019ce0f301e2c2090bb7adce806365320d4fea5e2d

    SHA512

    e131f0ea2b155154b0fc42c2327b95265465e46571070dc90ff98e3d078f9b086785fa10d9a1fcd748bfb404459477b31e7f50735618dadd87a1fec8b0742b53

  • C:\Users\Admin\AppData\Local\Temp\Tar327E.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Local\Temp\is-SSTEH.tmp\clipx-1.0.3.8-installer_CYph-n1.tmp

    Filesize

    3.0MB

    MD5

    e6c28eb71e3839115f44acbe4ab73729

    SHA1

    31a66495aa276692f5391a282122d60cd1cbeca0

    SHA256

    fe883c092e139f2a83c19ad272096b5f16b3794da9d7b1e9401216aebf079399

    SHA512

    aca216c42ee01d38e2df45df49fe9e0e8ba9e3366b3d3111a064db145277e4fded5ffe9ad12a45be5734fa0cf5c7272f6e4955b70f05cd5b2227ecd875ce2663

  • \Users\Admin\AppData\Local\Temp\is-SSTEH.tmp\clipx-1.0.3.8-installer_CYph-n1.tmp

    Filesize

    3.0MB

    MD5

    e6c28eb71e3839115f44acbe4ab73729

    SHA1

    31a66495aa276692f5391a282122d60cd1cbeca0

    SHA256

    fe883c092e139f2a83c19ad272096b5f16b3794da9d7b1e9401216aebf079399

    SHA512

    aca216c42ee01d38e2df45df49fe9e0e8ba9e3366b3d3111a064db145277e4fded5ffe9ad12a45be5734fa0cf5c7272f6e4955b70f05cd5b2227ecd875ce2663

  • memory/848-54-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/848-186-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/1692-61-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1692-187-0x0000000000400000-0x000000000071B000-memory.dmp

    Filesize

    3.1MB

  • memory/1692-188-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1692-190-0x0000000000400000-0x000000000071B000-memory.dmp

    Filesize

    3.1MB