Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2023, 05:11

General

  • Target

    tmp.exe

  • Size

    2.1MB

  • MD5

    f35b46814b3d6a04f58cf35f5933e2e5

  • SHA1

    c98a647667cb832f25bae1f9abbf6f31fd59d44d

  • SHA256

    af43b23fc74feae008425b251a81e26e6c4448182c18176124cadea8a621d770

  • SHA512

    5e89112e5dd120678d61e68022e0e6ae3c11c19bbff8abd90868c8e49272adc42eefc0c69d954ce68d3e4aa425fcd3defa08ccdc8593249dc029ce1bc38e14f0

  • SSDEEP

    49152:jnpItt2BP3CiuhGA+OtmbB2d6w5sb4GfoZRUzqGMmyklCgI0Hob/:aWBP3ghGA+DV2d6w044QUy9klCgIQob/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops file in Program Files directory 31 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM WebActiveEXE.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1044
    • C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM TimeGridEXE.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1988
    • C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe
      "C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe" /regserver
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:2728
    • C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe
      "C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe" /regserver
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      PID:2524
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "atl.dll"
      2⤵
        PID:2496

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe

      Filesize

      52KB

      MD5

      df0403f152b5482d17bedd9cf102910d

      SHA1

      774a9ece77bd214e91802eb3a1add5bcfa12875c

      SHA256

      3e5bab858d847cab5b986e1973571aec0e103b554fc47af171fba4c52d0bc57b

      SHA512

      f748c2ca0c349fd2b76cc1bf8585db8013633bd12d3a145076fd630b9415b9a2e57458d81809b9a89c9db83a77353a37fd08c64a472166950c4210e4928c6f16

    • C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe

      Filesize

      52KB

      MD5

      df0403f152b5482d17bedd9cf102910d

      SHA1

      774a9ece77bd214e91802eb3a1add5bcfa12875c

      SHA256

      3e5bab858d847cab5b986e1973571aec0e103b554fc47af171fba4c52d0bc57b

      SHA512

      f748c2ca0c349fd2b76cc1bf8585db8013633bd12d3a145076fd630b9415b9a2e57458d81809b9a89c9db83a77353a37fd08c64a472166950c4210e4928c6f16

    • C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe

      Filesize

      52KB

      MD5

      df0403f152b5482d17bedd9cf102910d

      SHA1

      774a9ece77bd214e91802eb3a1add5bcfa12875c

      SHA256

      3e5bab858d847cab5b986e1973571aec0e103b554fc47af171fba4c52d0bc57b

      SHA512

      f748c2ca0c349fd2b76cc1bf8585db8013633bd12d3a145076fd630b9415b9a2e57458d81809b9a89c9db83a77353a37fd08c64a472166950c4210e4928c6f16

    • C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe

      Filesize

      148KB

      MD5

      e44629962e2e3b7276371017c9dc7055

      SHA1

      0e1ed0e1669ff5a0cc97cda5184feea4b090335b

      SHA256

      31d39627b0923cba08562e24201e84c4e2c727675911b011e39115af9f20823b

      SHA512

      dfc32a1e9e30c1443a4d0d3e7cab4fc9de2a46879730b110340816a188251e2ca49c1d279f707defbb3729ef263e089b173514610ec52ec68d54a87cad31d19c

    • C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe

      Filesize

      148KB

      MD5

      e44629962e2e3b7276371017c9dc7055

      SHA1

      0e1ed0e1669ff5a0cc97cda5184feea4b090335b

      SHA256

      31d39627b0923cba08562e24201e84c4e2c727675911b011e39115af9f20823b

      SHA512

      dfc32a1e9e30c1443a4d0d3e7cab4fc9de2a46879730b110340816a188251e2ca49c1d279f707defbb3729ef263e089b173514610ec52ec68d54a87cad31d19c

    • C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe

      Filesize

      148KB

      MD5

      e44629962e2e3b7276371017c9dc7055

      SHA1

      0e1ed0e1669ff5a0cc97cda5184feea4b090335b

      SHA256

      31d39627b0923cba08562e24201e84c4e2c727675911b011e39115af9f20823b

      SHA512

      dfc32a1e9e30c1443a4d0d3e7cab4fc9de2a46879730b110340816a188251e2ca49c1d279f707defbb3729ef263e089b173514610ec52ec68d54a87cad31d19c

    • C:\Program Files (x86)\webrec\WEB30\WebPlugin\timeAxesDll.dll

      Filesize

      96KB

      MD5

      6c0ba557a4e06301cb1df042fe8c77a6

      SHA1

      766cee521e9be4a737cee365e12c8b927390980f

      SHA256

      c4a1cdc6dbfc8b63fa7e46f0bc98f3aa925f36da0500d8eb5ac3d8588c7a5385

      SHA512

      a94a7819330aa1d2616cbce86dca4fe67c55a03bc18b915b3f26507c5c03e543c1753b5b6bb60e70ce6b613516cbec0d57a72412639bea83522c5f0fa93d0cbf

    • C:\Users\Admin\AppData\Local\Temp\nsy4A7A.tmp\nsExec.dll

      Filesize

      6KB

      MD5

      acc2b699edfea5bf5aae45aba3a41e96

      SHA1

      d2accf4d494e43ceb2cff69abe4dd17147d29cc2

      SHA256

      168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

      SHA512

      e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

    • \Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe

      Filesize

      52KB

      MD5

      df0403f152b5482d17bedd9cf102910d

      SHA1

      774a9ece77bd214e91802eb3a1add5bcfa12875c

      SHA256

      3e5bab858d847cab5b986e1973571aec0e103b554fc47af171fba4c52d0bc57b

      SHA512

      f748c2ca0c349fd2b76cc1bf8585db8013633bd12d3a145076fd630b9415b9a2e57458d81809b9a89c9db83a77353a37fd08c64a472166950c4210e4928c6f16

    • \Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe

      Filesize

      52KB

      MD5

      df0403f152b5482d17bedd9cf102910d

      SHA1

      774a9ece77bd214e91802eb3a1add5bcfa12875c

      SHA256

      3e5bab858d847cab5b986e1973571aec0e103b554fc47af171fba4c52d0bc57b

      SHA512

      f748c2ca0c349fd2b76cc1bf8585db8013633bd12d3a145076fd630b9415b9a2e57458d81809b9a89c9db83a77353a37fd08c64a472166950c4210e4928c6f16

    • \Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe

      Filesize

      148KB

      MD5

      e44629962e2e3b7276371017c9dc7055

      SHA1

      0e1ed0e1669ff5a0cc97cda5184feea4b090335b

      SHA256

      31d39627b0923cba08562e24201e84c4e2c727675911b011e39115af9f20823b

      SHA512

      dfc32a1e9e30c1443a4d0d3e7cab4fc9de2a46879730b110340816a188251e2ca49c1d279f707defbb3729ef263e089b173514610ec52ec68d54a87cad31d19c

    • \Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe

      Filesize

      148KB

      MD5

      e44629962e2e3b7276371017c9dc7055

      SHA1

      0e1ed0e1669ff5a0cc97cda5184feea4b090335b

      SHA256

      31d39627b0923cba08562e24201e84c4e2c727675911b011e39115af9f20823b

      SHA512

      dfc32a1e9e30c1443a4d0d3e7cab4fc9de2a46879730b110340816a188251e2ca49c1d279f707defbb3729ef263e089b173514610ec52ec68d54a87cad31d19c

    • \Program Files (x86)\webrec\WEB30\WebPlugin\timeAxesDll.dll

      Filesize

      96KB

      MD5

      6c0ba557a4e06301cb1df042fe8c77a6

      SHA1

      766cee521e9be4a737cee365e12c8b927390980f

      SHA256

      c4a1cdc6dbfc8b63fa7e46f0bc98f3aa925f36da0500d8eb5ac3d8588c7a5385

      SHA512

      a94a7819330aa1d2616cbce86dca4fe67c55a03bc18b915b3f26507c5c03e543c1753b5b6bb60e70ce6b613516cbec0d57a72412639bea83522c5f0fa93d0cbf

    • \Users\Admin\AppData\Local\Temp\nsy4A7A.tmp\nsExec.dll

      Filesize

      6KB

      MD5

      acc2b699edfea5bf5aae45aba3a41e96

      SHA1

      d2accf4d494e43ceb2cff69abe4dd17147d29cc2

      SHA256

      168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

      SHA512

      e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe

    • \Users\Admin\AppData\Local\Temp\nsy4A7A.tmp\nsExec.dll

      Filesize

      6KB

      MD5

      acc2b699edfea5bf5aae45aba3a41e96

      SHA1

      d2accf4d494e43ceb2cff69abe4dd17147d29cc2

      SHA256

      168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e

      SHA512

      e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe