Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    27s
  • max time network
    64s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    13/06/2023, 15:18

General

  • Target

    file.exe

  • Size

    5.6MB

  • MD5

    91e0018d00f5782c53d8d0a5abc51914

  • SHA1

    24733e9f058ef81884085eeab0bbe32582775fee

  • SHA256

    4e998800b102360f87df8e0d379ace3ba4981f8fc158f1c88c30f494463994a5

  • SHA512

    eebfd3435d2105f7a9a3bc369c34c8c061813e4f9a5a7056824c9d37ef641d30e67b6fe75c0d395a440623635f0b5a56f6380b75f0287ba9e647992d0cc0d36e

  • SSDEEP

    98304:EDLrpHFOFnyavj0un+/crK8qfB8nzhF1GHdlpG6LVmrV9kpfBqD8m/d4ky3jmlWp:Evr9FO5cu+/KK8qfBwdF1QlpGq0x+/sC

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1384
      2⤵
      • Program crash
      PID:396

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\LocalSimbaQpwDJG_eo1z\freebl3.dll

    Filesize

    326KB

    MD5

    ef2834ac4ee7d6724f255beaf527e635

    SHA1

    5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

    SHA256

    a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

    SHA512

    c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

  • C:\Users\Admin\AppData\Local\Temp\LocalSimblQpwDJG_eo1z\information.txt

    Filesize

    3KB

    MD5

    876c4c9a19bbd37ab1e1d6113d97a7d5

    SHA1

    20101491fed32b039d3f6092f36edcd9054ec8e6

    SHA256

    6bfe2edfe0c97383d99c19ae4932e74e6ae99440441c6ab5b4b22ea3720c221f

    SHA512

    71c76e08de628047cdef79b0df516a4041653db2af90dc60f8752149b981a5cee657904f98261e250b41e9b8c61365c79bb7ced321e10bec19fcc91254a03865

  • \Users\Admin\AppData\Local\Temp\LocalSimbaQpwDJG_eo1z\freebl3.dll

    Filesize

    326KB

    MD5

    ef2834ac4ee7d6724f255beaf527e635

    SHA1

    5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

    SHA256

    a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

    SHA512

    c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

  • \Users\Admin\AppData\Local\Temp\LocalSimbaQpwDJG_eo1z\freebl3.dll

    Filesize

    326KB

    MD5

    ef2834ac4ee7d6724f255beaf527e635

    SHA1

    5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

    SHA256

    a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

    SHA512

    c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

  • \Users\Admin\AppData\Local\Temp\LocalSimbaQpwDJG_eo1z\freebl3.dll

    Filesize

    326KB

    MD5

    ef2834ac4ee7d6724f255beaf527e635

    SHA1

    5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

    SHA256

    a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

    SHA512

    c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

  • \Users\Admin\AppData\Local\Temp\LocalSimbaQpwDJG_eo1z\freebl3.dll

    Filesize

    326KB

    MD5

    ef2834ac4ee7d6724f255beaf527e635

    SHA1

    5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

    SHA256

    a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

    SHA512

    c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

  • \Users\Admin\AppData\Local\Temp\LocalSimbaQpwDJG_eo1z\freebl3.dll

    Filesize

    326KB

    MD5

    ef2834ac4ee7d6724f255beaf527e635

    SHA1

    5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

    SHA256

    a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

    SHA512

    c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

  • \Users\Admin\AppData\Local\Temp\LocalSimbaQpwDJG_eo1z\freebl3.dll

    Filesize

    326KB

    MD5

    ef2834ac4ee7d6724f255beaf527e635

    SHA1

    5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

    SHA256

    a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

    SHA512

    c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

  • \Users\Admin\AppData\Local\Temp\LocalSimbaQpwDJG_eo1z\mozglue.dll

    Filesize

    133KB

    MD5

    8f73c08a9660691143661bf7332c3c27

    SHA1

    37fa65dd737c50fda710fdbde89e51374d0c204a

    SHA256

    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

    SHA512

    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

  • \Users\Admin\AppData\Local\Temp\LocalSimbaQpwDJG_eo1z\nss3.dll

    Filesize

    1.2MB

    MD5

    bfac4e3c5908856ba17d41edcd455a51

    SHA1

    8eec7e888767aa9e4cca8ff246eb2aacb9170428

    SHA256

    e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

    SHA512

    2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

  • \Users\Admin\AppData\Local\Temp\LocalSimbaQpwDJG_eo1z\softokn3.dll

    Filesize

    141KB

    MD5

    a2ee53de9167bf0d6c019303b7ca84e5

    SHA1

    2a3c737fa1157e8483815e98b666408a18c0db42

    SHA256

    43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

    SHA512

    45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

  • \Users\Admin\AppData\Local\Temp\LocalSimbaQpwDJG_eo1z\softokn3.dll

    Filesize

    141KB

    MD5

    a2ee53de9167bf0d6c019303b7ca84e5

    SHA1

    2a3c737fa1157e8483815e98b666408a18c0db42

    SHA256

    43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

    SHA512

    45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

  • memory/1240-54-0x0000000000B50000-0x0000000001744000-memory.dmp

    Filesize

    12.0MB