Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    08/08/2023, 07:00

General

  • Target

    DRAWING-MATERIALS NEEDED.exe

  • Size

    273KB

  • MD5

    6ea128aad981db51fb37a219cb6b266e

  • SHA1

    37bdacba8fe247ff5ead7524a0ffc17b7dfbfdbc

  • SHA256

    63c7c7144d487bb38e9473ed1a7b420440b131981c5e83901614212f7d9bd8d8

  • SHA512

    dfd285c8fb0026025a1c60c46efd0c02d9cd5741e04219c5cb1aaeba9f08e0c3f42735f5f6d1bb61294cef203aa3e6caa60fec879b4b6940f6641e0b6c42bac3

  • SSDEEP

    6144:YzAJFXG1/PZthjld/77Pm3pHT5EzjDu7w5x:CCar377ypz5ELu7w5x

Score
10/10

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Checks QEMU agent file 2 TTPs 1 IoCs

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DRAWING-MATERIALS NEEDED.exe
    "C:\Users\Admin\AppData\Local\Temp\DRAWING-MATERIALS NEEDED.exe"
    1⤵
    • Checks QEMU agent file
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 492
      2⤵
      • Program crash
      PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsd6D54.tmp\System.dll

    Filesize

    11KB

    MD5

    4d3b19a81bd51f8ce44b93643a4e3a99

    SHA1

    35f8b00e85577b014080df98bd2c378351d9b3e9

    SHA256

    fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce

    SHA512

    b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622

  • memory/1648-65-0x00000000030C0000-0x0000000003CB8000-memory.dmp

    Filesize

    12.0MB

  • memory/1648-66-0x00000000030C0000-0x0000000003CB8000-memory.dmp

    Filesize

    12.0MB

  • memory/1648-67-0x0000000076E00000-0x0000000076FA9000-memory.dmp

    Filesize

    1.7MB

  • memory/1648-68-0x0000000076FF0000-0x00000000770C6000-memory.dmp

    Filesize

    856KB