Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    04/08/2023, 18:27

General

  • Target

    681c791a6f355b0c9a64468f811ed8fe_magniber_metamorfo_JC.exe

  • Size

    17.5MB

  • MD5

    681c791a6f355b0c9a64468f811ed8fe

  • SHA1

    90133ade77eebabfd60fd757c1eb646d9229b88b

  • SHA256

    d32ca907c025975c5f368d7693b3b8193729d20c8012ce31ace19b1e6e45dfce

  • SHA512

    33f0267c2dae79ef6158ceaf9d7c556c1f8e086ca28a49d86ee0f34ac7e81665bd813d1a216701f5555f77839a06f94ba3827fb78d026f8f087683c321fdd0fb

  • SSDEEP

    393216:GBLQElVCTK2IUzi1/oHirqNZnGFm1dErsM:GNlVCeUcSbnF1O

Score
4/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\681c791a6f355b0c9a64468f811ed8fe_magniber_metamorfo_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\681c791a6f355b0c9a64468f811ed8fe_magniber_metamorfo_JC.exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\ProgramData\Soda PDF Desktop 12\Installation\analytics.dll"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:2616
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{EA99D9A6-92E7-43AD-9616-97BEA0A8CC1B}
    1⤵
    • Loads dropped DLL
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Soda PDF Desktop 12\Installation\analytics.dll

    Filesize

    1.8MB

    MD5

    5493a084d808a3d45a57883baa96be4a

    SHA1

    2aa574a327a3a439efcaf7b5ee955976d96fce17

    SHA256

    4602687201bf3c01975b6a744fe9dabb342f3051ad54c7bbef2e5cffe606bdf4

    SHA512

    8f2ce053b2d143bb9666caa1a290e177a8af38b375cce31e301f6bf0d956e6a52c25ace95e634daf51c7aa2847f3cdd5eb4d15ae7953e1dc18997ef1190e7af5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b4ff6d3c18a23706e27fe611993d6774

    SHA1

    b1685ac80c4faed98c9f2bf4d8147de3bda25ca4

    SHA256

    ace2accdb7b222d394211cbd3b70adbb1dbfd6051a770541f36bc7c8049edeb4

    SHA512

    a3a74876706db6458209031da088c9b77010a43d761f6f2803d9fa5659e792bf0eb9edb9279e787b42eec5eb8fa809775f6ba20592a7d683fb367cda888fca4a

  • C:\Users\Admin\AppData\Local\Temp\Cab8F85.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar8FA7.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • \ProgramData\Soda PDF Desktop 12\Installation\analytics.dll

    Filesize

    1.8MB

    MD5

    5493a084d808a3d45a57883baa96be4a

    SHA1

    2aa574a327a3a439efcaf7b5ee955976d96fce17

    SHA256

    4602687201bf3c01975b6a744fe9dabb342f3051ad54c7bbef2e5cffe606bdf4

    SHA512

    8f2ce053b2d143bb9666caa1a290e177a8af38b375cce31e301f6bf0d956e6a52c25ace95e634daf51c7aa2847f3cdd5eb4d15ae7953e1dc18997ef1190e7af5

  • \ProgramData\Soda PDF Desktop 12\Installation\analytics.dll

    Filesize

    1.8MB

    MD5

    5493a084d808a3d45a57883baa96be4a

    SHA1

    2aa574a327a3a439efcaf7b5ee955976d96fce17

    SHA256

    4602687201bf3c01975b6a744fe9dabb342f3051ad54c7bbef2e5cffe606bdf4

    SHA512

    8f2ce053b2d143bb9666caa1a290e177a8af38b375cce31e301f6bf0d956e6a52c25ace95e634daf51c7aa2847f3cdd5eb4d15ae7953e1dc18997ef1190e7af5

  • \ProgramData\Soda PDF Desktop 12\Installation\analytics.dll

    Filesize

    1.8MB

    MD5

    5493a084d808a3d45a57883baa96be4a

    SHA1

    2aa574a327a3a439efcaf7b5ee955976d96fce17

    SHA256

    4602687201bf3c01975b6a744fe9dabb342f3051ad54c7bbef2e5cffe606bdf4

    SHA512

    8f2ce053b2d143bb9666caa1a290e177a8af38b375cce31e301f6bf0d956e6a52c25ace95e634daf51c7aa2847f3cdd5eb4d15ae7953e1dc18997ef1190e7af5

  • \ProgramData\Soda PDF Desktop 12\Installation\analytics.dll

    Filesize

    1.8MB

    MD5

    5493a084d808a3d45a57883baa96be4a

    SHA1

    2aa574a327a3a439efcaf7b5ee955976d96fce17

    SHA256

    4602687201bf3c01975b6a744fe9dabb342f3051ad54c7bbef2e5cffe606bdf4

    SHA512

    8f2ce053b2d143bb9666caa1a290e177a8af38b375cce31e301f6bf0d956e6a52c25ace95e634daf51c7aa2847f3cdd5eb4d15ae7953e1dc18997ef1190e7af5

  • \ProgramData\Soda PDF Desktop 12\Installation\analytics.dll

    Filesize

    1.8MB

    MD5

    5493a084d808a3d45a57883baa96be4a

    SHA1

    2aa574a327a3a439efcaf7b5ee955976d96fce17

    SHA256

    4602687201bf3c01975b6a744fe9dabb342f3051ad54c7bbef2e5cffe606bdf4

    SHA512

    8f2ce053b2d143bb9666caa1a290e177a8af38b375cce31e301f6bf0d956e6a52c25ace95e634daf51c7aa2847f3cdd5eb4d15ae7953e1dc18997ef1190e7af5