Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2023, 01:19

General

  • Target

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe

  • Size

    8.2MB

  • MD5

    49821681a577c7aa118eca3400d71d53

  • SHA1

    e96ae5a5f90e3a4622b64e91d374bbbd102165d3

  • SHA256

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88

  • SHA512

    5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002

  • SSDEEP

    196608:ihTb9B0BPrDz4pxgZZPy5RmStgxb/z6FDiSJXqeUh4mT:MTb9epDz4MZZ4RmxYDiScfhH

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
    "C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1996
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1344
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1756
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88" /tr "C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe"
      2⤵
      • Creates scheduled task(s)
      PID:1536
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {0A0AF473-3290-4637-A4C5-394BD5AF7B8E} S-1-5-21-3297628651-743815474-1126733160-1000:HHVWDVKF\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
      C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1600
    • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
      C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
      2⤵
      • Executes dropped EXE
      PID:1812

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe

    Filesize

    8.2MB

    MD5

    49821681a577c7aa118eca3400d71d53

    SHA1

    e96ae5a5f90e3a4622b64e91d374bbbd102165d3

    SHA256

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88

    SHA512

    5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002

  • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe

    Filesize

    8.2MB

    MD5

    49821681a577c7aa118eca3400d71d53

    SHA1

    e96ae5a5f90e3a4622b64e91d374bbbd102165d3

    SHA256

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88

    SHA512

    5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002

  • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe

    Filesize

    8.2MB

    MD5

    49821681a577c7aa118eca3400d71d53

    SHA1

    e96ae5a5f90e3a4622b64e91d374bbbd102165d3

    SHA256

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88

    SHA512

    5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002

  • C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe

    Filesize

    8.2MB

    MD5

    49821681a577c7aa118eca3400d71d53

    SHA1

    e96ae5a5f90e3a4622b64e91d374bbbd102165d3

    SHA256

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88

    SHA512

    5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G919DCH8XQ3GZAHKW32Z.temp

    Filesize

    7KB

    MD5

    76f5d4f94139aaf6e01b228583d1e4b9

    SHA1

    7aa0634c9219736ffc8cef101c566ef8ef560ae4

    SHA256

    8dbd680f3dc1a9f235aea865ae6869250cfca17c5593e54f4ee43d74ecc9faee

    SHA512

    512934774d8c10336f5e285e199878b27291304471acdc69f39db8707567c53fe629681cb0b0f32ec6c3b010c208063bbf40dbdeaed590dbac9b7d8d95249efb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    76f5d4f94139aaf6e01b228583d1e4b9

    SHA1

    7aa0634c9219736ffc8cef101c566ef8ef560ae4

    SHA256

    8dbd680f3dc1a9f235aea865ae6869250cfca17c5593e54f4ee43d74ecc9faee

    SHA512

    512934774d8c10336f5e285e199878b27291304471acdc69f39db8707567c53fe629681cb0b0f32ec6c3b010c208063bbf40dbdeaed590dbac9b7d8d95249efb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    76f5d4f94139aaf6e01b228583d1e4b9

    SHA1

    7aa0634c9219736ffc8cef101c566ef8ef560ae4

    SHA256

    8dbd680f3dc1a9f235aea865ae6869250cfca17c5593e54f4ee43d74ecc9faee

    SHA512

    512934774d8c10336f5e285e199878b27291304471acdc69f39db8707567c53fe629681cb0b0f32ec6c3b010c208063bbf40dbdeaed590dbac9b7d8d95249efb

  • \Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe

    Filesize

    8.2MB

    MD5

    49821681a577c7aa118eca3400d71d53

    SHA1

    e96ae5a5f90e3a4622b64e91d374bbbd102165d3

    SHA256

    2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88

    SHA512

    5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002

  • memory/1600-99-0x0000000008EA0000-0x0000000008EA6000-memory.dmp

    Filesize

    24KB

  • memory/1600-98-0x0000000008E80000-0x0000000008E86000-memory.dmp

    Filesize

    24KB

  • memory/1600-97-0x0000000004A70000-0x0000000004AB0000-memory.dmp

    Filesize

    256KB

  • memory/1600-95-0x0000000000040000-0x0000000000886000-memory.dmp

    Filesize

    8.3MB

  • memory/1704-61-0x0000000004AB0000-0x0000000004B26000-memory.dmp

    Filesize

    472KB

  • memory/1704-59-0x0000000006E90000-0x0000000007508000-memory.dmp

    Filesize

    6.5MB

  • memory/1704-68-0x0000000008FE0000-0x0000000008FE6000-memory.dmp

    Filesize

    24KB

  • memory/1704-69-0x0000000008FF0000-0x0000000009006000-memory.dmp

    Filesize

    88KB

  • memory/1704-70-0x0000000005110000-0x0000000005150000-memory.dmp

    Filesize

    256KB

  • memory/1704-55-0x0000000005110000-0x0000000005150000-memory.dmp

    Filesize

    256KB

  • memory/1704-66-0x0000000007BB0000-0x0000000007BB8000-memory.dmp

    Filesize

    32KB

  • memory/1704-65-0x0000000004F90000-0x0000000004F98000-memory.dmp

    Filesize

    32KB

  • memory/1704-64-0x0000000002930000-0x000000000294E000-memory.dmp

    Filesize

    120KB

  • memory/1704-63-0x0000000000C50000-0x0000000000C58000-memory.dmp

    Filesize

    32KB

  • memory/1704-62-0x0000000000C20000-0x0000000000C46000-memory.dmp

    Filesize

    152KB

  • memory/1704-54-0x0000000000CE0000-0x0000000001526000-memory.dmp

    Filesize

    8.3MB

  • memory/1704-60-0x0000000000530000-0x0000000000538000-memory.dmp

    Filesize

    32KB

  • memory/1704-67-0x0000000008FC0000-0x0000000008FC6000-memory.dmp

    Filesize

    24KB

  • memory/1704-58-0x0000000000A30000-0x0000000000A62000-memory.dmp

    Filesize

    200KB

  • memory/1704-57-0x0000000000A00000-0x0000000000A1A000-memory.dmp

    Filesize

    104KB

  • memory/1704-56-0x0000000005530000-0x00000000059B8000-memory.dmp

    Filesize

    4.5MB

  • memory/1812-101-0x0000000000E70000-0x00000000016B6000-memory.dmp

    Filesize

    8.3MB

  • memory/1996-73-0x0000000002330000-0x0000000002370000-memory.dmp

    Filesize

    256KB