Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    34s
  • max time network
    98s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    16/06/2023, 22:59

General

  • Target

    61a8a4a365edf225943d7fb5f27827c7730df5c34189e2dac1f5f23c089f79dd.exe

  • Size

    5.8MB

  • MD5

    a667b2dd0089600c4106fcc5e2d215c0

  • SHA1

    e226aaca862224f6cc8348accf3b4464e0ad3741

  • SHA256

    61a8a4a365edf225943d7fb5f27827c7730df5c34189e2dac1f5f23c089f79dd

  • SHA512

    a2c27b4c42d99ebbe1c3a35c268922b2e613abf491cbee32de13ff79340c54d3ecfb157e56f27f99e2c08fbe0b68d459616d8e36c85a168fff36d490f6d23944

  • SSDEEP

    98304:zX55fiwwWVfqPGCPG0Z2Hb57nVuUikaH5gBxNEjYS2/+:zuww3Zab57nPraH2rNEjYSW+

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61a8a4a365edf225943d7fb5f27827c7730df5c34189e2dac1f5f23c089f79dd.exe
    "C:\Users\Admin\AppData\Local\Temp\61a8a4a365edf225943d7fb5f27827c7730df5c34189e2dac1f5f23c089f79dd.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\Utils\DumpUper.exe
      "C:\Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\Utils\DumpUper.exe" --pep=50851628 --pid=1232 --tid=1072 --src=catainstall --ver=1.2023.1005.513 --rep=1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1988

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar2286.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\7z.dll

    Filesize

    1.1MB

    MD5

    2ab776c5c3d0907bd0379a9f28faa552

    SHA1

    3830c73548f0ddd9e6b4d8519fd8c1e49797449c

    SHA256

    cd5d367e02d7a8a48f7ce97fe4d9b3b30d554031523e79c9e4aa3dd6eedb0ed8

    SHA512

    67d25ad243f8e05dcab3efc9651cd16f8e094aa11ddc04322457b5ecfebfca64ad762cb0fb26616660fd3051be54071b26f99270c814fe916637cea1e6e55993

  • C:\Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\NetBridge.dll

    Filesize

    238KB

    MD5

    8786d469338c30e0ba9fedfc62bd5197

    SHA1

    5fb12028ceae9772f938e1b98b699f0e02e32718

    SHA256

    beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f

    SHA512

    5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c

  • C:\Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\Utils\DumpUper.exe

    Filesize

    1.0MB

    MD5

    eae07326b209814995a435d657ffa46e

    SHA1

    df58c2248aa64722da47b24f4a60379d408239e5

    SHA256

    a8246af966f52e36ed8f2444e378e5e6c7f3f4988e9ede19c6f876aaf8abdbfe

    SHA512

    3f9accd44e59ec811e9e52d939a7b991b60bc453dd946fb46bbd4162908295be582f5ad99dd434f35324f472bc76a7fde91858f73b9dac2236d1eade5dae5881

  • C:\Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\auth.dll

    Filesize

    646KB

    MD5

    ffda1cc904157c18535af8a5278f83b4

    SHA1

    54fd0c98b543db436a42d81c4b3e778a1913b929

    SHA256

    969abfceb54b61a705eb757af3cf47c583f11e16d56d1596a3804ddf328930ce

    SHA512

    6cdffee12abd53e51db606e52cf1b577fdbdfb2e57ef06d5d4e57e837910fd1f6a7c831722aac180ee445a6400aaac1dc624e341868b8f1936cb895b63c5e5f6

  • \Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\7z.dll

    Filesize

    1.1MB

    MD5

    2ab776c5c3d0907bd0379a9f28faa552

    SHA1

    3830c73548f0ddd9e6b4d8519fd8c1e49797449c

    SHA256

    cd5d367e02d7a8a48f7ce97fe4d9b3b30d554031523e79c9e4aa3dd6eedb0ed8

    SHA512

    67d25ad243f8e05dcab3efc9651cd16f8e094aa11ddc04322457b5ecfebfca64ad762cb0fb26616660fd3051be54071b26f99270c814fe916637cea1e6e55993

  • \Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\7z.dll

    Filesize

    1.1MB

    MD5

    2ab776c5c3d0907bd0379a9f28faa552

    SHA1

    3830c73548f0ddd9e6b4d8519fd8c1e49797449c

    SHA256

    cd5d367e02d7a8a48f7ce97fe4d9b3b30d554031523e79c9e4aa3dd6eedb0ed8

    SHA512

    67d25ad243f8e05dcab3efc9651cd16f8e094aa11ddc04322457b5ecfebfca64ad762cb0fb26616660fd3051be54071b26f99270c814fe916637cea1e6e55993

  • \Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\7z.dll

    Filesize

    1.1MB

    MD5

    2ab776c5c3d0907bd0379a9f28faa552

    SHA1

    3830c73548f0ddd9e6b4d8519fd8c1e49797449c

    SHA256

    cd5d367e02d7a8a48f7ce97fe4d9b3b30d554031523e79c9e4aa3dd6eedb0ed8

    SHA512

    67d25ad243f8e05dcab3efc9651cd16f8e094aa11ddc04322457b5ecfebfca64ad762cb0fb26616660fd3051be54071b26f99270c814fe916637cea1e6e55993

  • \Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\NetBridge.dll

    Filesize

    238KB

    MD5

    8786d469338c30e0ba9fedfc62bd5197

    SHA1

    5fb12028ceae9772f938e1b98b699f0e02e32718

    SHA256

    beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f

    SHA512

    5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c

  • \Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\Utils\DumpUper.exe

    Filesize

    1.0MB

    MD5

    eae07326b209814995a435d657ffa46e

    SHA1

    df58c2248aa64722da47b24f4a60379d408239e5

    SHA256

    a8246af966f52e36ed8f2444e378e5e6c7f3f4988e9ede19c6f876aaf8abdbfe

    SHA512

    3f9accd44e59ec811e9e52d939a7b991b60bc453dd946fb46bbd4162908295be582f5ad99dd434f35324f472bc76a7fde91858f73b9dac2236d1eade5dae5881

  • \Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\auth.dll

    Filesize

    646KB

    MD5

    ffda1cc904157c18535af8a5278f83b4

    SHA1

    54fd0c98b543db436a42d81c4b3e778a1913b929

    SHA256

    969abfceb54b61a705eb757af3cf47c583f11e16d56d1596a3804ddf328930ce

    SHA512

    6cdffee12abd53e51db606e52cf1b577fdbdfb2e57ef06d5d4e57e837910fd1f6a7c831722aac180ee445a6400aaac1dc624e341868b8f1936cb895b63c5e5f6

  • \Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\auth.dll

    Filesize

    646KB

    MD5

    ffda1cc904157c18535af8a5278f83b4

    SHA1

    54fd0c98b543db436a42d81c4b3e778a1913b929

    SHA256

    969abfceb54b61a705eb757af3cf47c583f11e16d56d1596a3804ddf328930ce

    SHA512

    6cdffee12abd53e51db606e52cf1b577fdbdfb2e57ef06d5d4e57e837910fd1f6a7c831722aac180ee445a6400aaac1dc624e341868b8f1936cb895b63c5e5f6

  • \Users\Admin\AppData\Local\Temp\{F7A15E33-308C-410e-B480-9BCAD13445C9}.tmp\auth.dll

    Filesize

    646KB

    MD5

    ffda1cc904157c18535af8a5278f83b4

    SHA1

    54fd0c98b543db436a42d81c4b3e778a1913b929

    SHA256

    969abfceb54b61a705eb757af3cf47c583f11e16d56d1596a3804ddf328930ce

    SHA512

    6cdffee12abd53e51db606e52cf1b577fdbdfb2e57ef06d5d4e57e837910fd1f6a7c831722aac180ee445a6400aaac1dc624e341868b8f1936cb895b63c5e5f6

  • memory/1988-149-0x00000000009B0000-0x00000000009B1000-memory.dmp

    Filesize

    4KB