Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    54s
  • max time network
    58s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2023, 20:01

General

  • Target

    Decent_Sampler-1.8.12.0-Windows.exe

  • Size

    31.7MB

  • MD5

    1fb5e8893336b758740944ea0f2965a8

  • SHA1

    8a849d422806fac01693ef44402bdf9ec14d34ba

  • SHA256

    8ffc45ed98a4e16a0e2e58eb9e35f6f73a3a7520adb2e7e9360d7acead3a5f8c

  • SHA512

    61acb91b0eaeb452604bcddf3004c37aafdd01d89b9532b40a4471a975414c3531eff9ae43243b1ccc418b64e59c5ae8d4bcebb6a7a0cd9874a7274d6537b44d

  • SSDEEP

    786432:t+CMjkyOX0+Q/JQViulnYrsDDc4u3Mwh1+G1opCMi2KH:5GLGkWViu6I3Fw04oQMi

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe
    "C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\is-JR9LK.tmp\Decent_Sampler-1.8.12.0-Windows.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-JR9LK.tmp\Decent_Sampler-1.8.12.0-Windows.tmp" /SL5="$80122,32361468,831488,C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:1996

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-JR9LK.tmp\Decent_Sampler-1.8.12.0-Windows.tmp

    Filesize

    3.0MB

    MD5

    bbd72aa568e9f2c3e67f5c6db24e9d3e

    SHA1

    5a6bbbcfaac32e7ad3d25d77f65efd3794cc83d3

    SHA256

    ee8b8339f58e9ac39efe9b27c29bf9b5a6f09028f231c2f5f7e671760ee8622e

    SHA512

    f94abb0e5bb0829472db638b5ec846e5580ec792fe0f21be6ea2745aa2c87b7a1782111dafb5350b2089bf672fcdfd08059d750ce87f2448761c95c983e14741

  • C:\Users\Admin\AppData\Local\Temp\is-JR9LK.tmp\Decent_Sampler-1.8.12.0-Windows.tmp

    Filesize

    3.0MB

    MD5

    bbd72aa568e9f2c3e67f5c6db24e9d3e

    SHA1

    5a6bbbcfaac32e7ad3d25d77f65efd3794cc83d3

    SHA256

    ee8b8339f58e9ac39efe9b27c29bf9b5a6f09028f231c2f5f7e671760ee8622e

    SHA512

    f94abb0e5bb0829472db638b5ec846e5580ec792fe0f21be6ea2745aa2c87b7a1782111dafb5350b2089bf672fcdfd08059d750ce87f2448761c95c983e14741

  • \Program Files\Decent Sampler\unins000.exe

    Filesize

    3.1MB

    MD5

    8a54aa9cbfa07bd0400258b60aa22fb8

    SHA1

    73a6fda9a8d2ccbe041a435706e2fa9090aaa89c

    SHA256

    af114b34c9c332e19cc9ddc205999924a2cb5d46d7a213ec87d3679f778b05b5

    SHA512

    3e98a46144461584f3f4d8f37dc777576fa0d831240dfc02e60d7e6d2d18fa769bbac58888410d96c5035ce0effbc8539d681daf1ba97add746a6bb4f3873da1

  • \Users\Admin\AppData\Local\Temp\is-JR9LK.tmp\Decent_Sampler-1.8.12.0-Windows.tmp

    Filesize

    3.0MB

    MD5

    bbd72aa568e9f2c3e67f5c6db24e9d3e

    SHA1

    5a6bbbcfaac32e7ad3d25d77f65efd3794cc83d3

    SHA256

    ee8b8339f58e9ac39efe9b27c29bf9b5a6f09028f231c2f5f7e671760ee8622e

    SHA512

    f94abb0e5bb0829472db638b5ec846e5580ec792fe0f21be6ea2745aa2c87b7a1782111dafb5350b2089bf672fcdfd08059d750ce87f2448761c95c983e14741

  • memory/1712-92-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/1712-64-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/1712-55-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/1996-67-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1996-71-0x0000000000400000-0x000000000071A000-memory.dmp

    Filesize

    3.1MB

  • memory/1996-73-0x0000000000400000-0x000000000071A000-memory.dmp

    Filesize

    3.1MB

  • memory/1996-69-0x0000000000400000-0x000000000071A000-memory.dmp

    Filesize

    3.1MB

  • memory/1996-78-0x0000000000400000-0x000000000071A000-memory.dmp

    Filesize

    3.1MB

  • memory/1996-66-0x0000000000400000-0x000000000071A000-memory.dmp

    Filesize

    3.1MB

  • memory/1996-91-0x0000000000400000-0x000000000071A000-memory.dmp

    Filesize

    3.1MB

  • memory/1996-62-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB