Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    08/10/2023, 15:06

General

  • Target

    b17792ca75a95f10df51aca2923bed7de23d348c0b72f958bcb742596f3eae32.exe

  • Size

    10.5MB

  • MD5

    f0f19d82eacc1092958786f26b0b3b8e

  • SHA1

    bbda35a5df905bf2c348bde3b819e12bbfacb756

  • SHA256

    b17792ca75a95f10df51aca2923bed7de23d348c0b72f958bcb742596f3eae32

  • SHA512

    5948504b708bde4611d506915d1e5655f35fa02599e192a757021b83d60cd4ee4bfd8ee72f920b2057822cf4e0345923c71b59ddc678d713e43846ae88395de5

  • SSDEEP

    196608:3UNcmESUPzE+rRjZL8S6EpTfcKr7yhACCt35TkKdfaQcYhUx2YVP0YlHWbby5+fe:8wIaVZgRQfXr7MAC6JF0oaIY5Vlafnho

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b17792ca75a95f10df51aca2923bed7de23d348c0b72f958bcb742596f3eae32.exe
    "C:\Users\Admin\AppData\Local\Temp\b17792ca75a95f10df51aca2923bed7de23d348c0b72f958bcb742596f3eae32.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c del "C:\Users\Admin\AppData\Local\Temp\*792ca75a95f10df51aca2923bed7de23d348c0b72f958bcb742596f3eae32.exe"
      2⤵
        PID:2396
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"
        2⤵
          PID:2452

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\246c507388ad5823241573c5bb5dc347.ini

        Filesize

        1KB

        MD5

        cd02f65648bc463d1cff64c7fcd7c4e5

        SHA1

        91c0dd38199acd87efc7590c2ceb8c5a5cbdfd34

        SHA256

        4ab5e48e9edbe80a927745c0e055c2800f356ac542ecfa0e0079caf87c5fadef

        SHA512

        eed4b528404be6b8a2d0289f7e117fa43dd8be69444e7be2fea159071647aaa6690bab10c0b4b1ba457585da713d81f19162765b71bd6f9f8a804462b7bdc91c

      • C:\Users\Admin\AppData\Local\Temp\246c507388ad5823241573c5bb5dc347A.ini

        Filesize

        1KB

        MD5

        c0d7496332120d41a7e02d3411d9c5dc

        SHA1

        e6ba7a30c5f3f86b57f48e61cfec77861492f223

        SHA256

        538e316246ac4dbba92b1e7af7d195c67e5cdb096ead70f5a795450bfafdab7c

        SHA512

        31f720082fa8c66e04f3ef833acd8073c75ae98ba6ce6eae81b22c422c2fff673a39b9963cc65d9e8ddb144d261c0fcb87ae826979cc28044abda6be9658ef08

      • C:\Users\Admin\AppData\Local\Temp\b17792ca75a95f10df51aca2923bed7de23d348c0b72f958bcb742596f3eae32.exepack.tmp

        Filesize

        2KB

        MD5

        2da3deba5f134c4fffcd557789ff42fe

        SHA1

        eb96ba3ea478e84251b18f0ad77181938075edde

        SHA256

        62056286fbe574327b8fe2b0b899e73b9c155e7af5899ed41acf5550843625f8

        SHA512

        f66988b6be82ada5f27652bed6a807ceea5ba9b1cc57f8e821cd2f912db3ecb99c461d74ca943b29ef0e1b79b0d3f559c5c45047de6d9a399517bff43631574b

      • memory/2688-347-0x0000000003970000-0x0000000003980000-memory.dmp

        Filesize

        64KB

      • memory/2688-368-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-2-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-1-0x0000000000240000-0x0000000000243000-memory.dmp

        Filesize

        12KB

      • memory/2688-339-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-340-0x0000000000240000-0x0000000000243000-memory.dmp

        Filesize

        12KB

      • memory/2688-341-0x0000000050000000-0x0000000050109000-memory.dmp

        Filesize

        1.0MB

      • memory/2688-342-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-343-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-0-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-350-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-5-0x0000000050000000-0x0000000050109000-memory.dmp

        Filesize

        1.0MB

      • memory/2688-372-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-374-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-375-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-376-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-377-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-378-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-379-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-380-0x0000000003970000-0x0000000003980000-memory.dmp

        Filesize

        64KB

      • memory/2688-381-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-382-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB

      • memory/2688-383-0x0000000000400000-0x0000000001EFA000-memory.dmp

        Filesize

        27.0MB