Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2023, 06:26

General

  • Target

    95d338b145f56210124399d4b2b309291075e365cb9ea19665e0eefaa09abb4a.exe

  • Size

    2.7MB

  • MD5

    40420292a6806912eca11bd33bbd6e41

  • SHA1

    d9f970de792fb4e724d34b4b335dc81ed8e71d23

  • SHA256

    95d338b145f56210124399d4b2b309291075e365cb9ea19665e0eefaa09abb4a

  • SHA512

    5c8a4227a7e9b40c837e7a96368cfaecc0d81acedce9ce0f4a7f53f2a89af53d6b95ecb439f12c85e6cbbb3ea7af0fc239d6144b2852e0cb7f8ed31ccd6a6a97

  • SSDEEP

    49152:ITGkQU5QZuTtS0rQMYOQ+q8CEGTG4QoTGHQV9KFeMz:IKkDWsM0r1QnJK4ZKHq0FeS

Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 56 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:420
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Users\Admin\AppData\Local\Temp\95d338b145f56210124399d4b2b309291075e365cb9ea19665e0eefaa09abb4a.exe
        "C:\Users\Admin\AppData\Local\Temp\95d338b145f56210124399d4b2b309291075e365cb9ea19665e0eefaa09abb4a.exe"
        2⤵
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\95d338b145f56210124399d4b2b309291075e365cb9ea19665e0eefaa09abb4a.exe"
          3⤵
          • Deletes itself
          • Suspicious use of WriteProcessMemory
          PID:1164
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 1
            4⤵
            • Delays execution with timeout.exe
            PID:2004
      • C:\ProgramData\powercfg.exe
        "C:\ProgramData\powercfg.exe"
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2764
    • C:\Windows\Syswow64\d95c7453
      C:\Windows\Syswow64\d95c7453
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Windows\Syswow64\d95c7453"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 1
          3⤵
          • Delays execution with timeout.exe
          PID:1768

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\powercfg.exe

      Filesize

      69KB

      MD5

      f779ee89cd1f679c91ab8848c978f086

      SHA1

      a2fdcc215c1ab0cb2be8a1d9db5362a6d1b756e9

      SHA256

      12279d4d2d7f80562f79d4dbcb7b63428e924c30a5e95f45cb0d08001a9cbddc

      SHA512

      5af862211a8841bd6a205ed6c9a06ab52f393d08a41c94a814f399dda28d20641ee3abbeefecaaba6bf0d0edd83d6ccf72675ca0e40e7d56966a035c3f4bb822

    • C:\Users\Admin\AppData\Local\Temp\CabAAD0.tmp

      Filesize

      61KB

      MD5

      f3441b8572aae8801c04f3060b550443

      SHA1

      4ef0a35436125d6821831ef36c28ffaf196cda15

      SHA256

      6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

      SHA512

      5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    • C:\Windows\SysWOW64\d95c7453

      Filesize

      2.7MB

      MD5

      bb5292bc0fab8194c9f29c7b2c7abfa7

      SHA1

      a765b241f1e3990b88f179ab4ef0b127f387a4a2

      SHA256

      047c35f2bbc6419a2d3cc340f7b16b7e0ada2fe987d0b594b8b8255d6f4d37b6

      SHA512

      9a5c23bbd02e89f9c5f9301e1fcec7d7b1469e7635f1517f5e3bd5f33c3810e88243062ced3c2061913f3d100135edfb79b9592fa18ee616eba476dae3d470b0

    • C:\Windows\Syswow64\d95c7453

      Filesize

      2.7MB

      MD5

      bb5292bc0fab8194c9f29c7b2c7abfa7

      SHA1

      a765b241f1e3990b88f179ab4ef0b127f387a4a2

      SHA256

      047c35f2bbc6419a2d3cc340f7b16b7e0ada2fe987d0b594b8b8255d6f4d37b6

      SHA512

      9a5c23bbd02e89f9c5f9301e1fcec7d7b1469e7635f1517f5e3bd5f33c3810e88243062ced3c2061913f3d100135edfb79b9592fa18ee616eba476dae3d470b0

    • C:\Windows\Temp\TarB2FD.tmp

      Filesize

      163KB

      MD5

      9441737383d21192400eca82fda910ec

      SHA1

      725e0d606a4fc9ba44aa8ffde65bed15e65367e4

      SHA256

      bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

      SHA512

      7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

    • \ProgramData\powercfg.exe

      Filesize

      69KB

      MD5

      f779ee89cd1f679c91ab8848c978f086

      SHA1

      a2fdcc215c1ab0cb2be8a1d9db5362a6d1b756e9

      SHA256

      12279d4d2d7f80562f79d4dbcb7b63428e924c30a5e95f45cb0d08001a9cbddc

      SHA512

      5af862211a8841bd6a205ed6c9a06ab52f393d08a41c94a814f399dda28d20641ee3abbeefecaaba6bf0d0edd83d6ccf72675ca0e40e7d56966a035c3f4bb822

    • memory/420-52-0x00000000007F0000-0x0000000000818000-memory.dmp

      Filesize

      160KB

    • memory/1224-127-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-154-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-164-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-163-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-26-0x0000000006240000-0x0000000006337000-memory.dmp

      Filesize

      988KB

    • memory/1224-162-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-161-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-160-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-143-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-131-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-159-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-142-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-25-0x0000000002A70000-0x0000000002A73000-memory.dmp

      Filesize

      12KB

    • memory/1224-141-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-23-0x0000000002A70000-0x0000000002A73000-memory.dmp

      Filesize

      12KB

    • memory/1224-140-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-21-0x0000000002A70000-0x0000000002A73000-memory.dmp

      Filesize

      12KB

    • memory/1224-99-0x0000000006240000-0x0000000006337000-memory.dmp

      Filesize

      988KB

    • memory/1224-139-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-129-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-158-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-138-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-157-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-156-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-155-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-144-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-153-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-152-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-151-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-150-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-149-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-148-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-125-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-137-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-147-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-128-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-146-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-130-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-145-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-132-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-133-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-134-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-135-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1224-136-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

      Filesize

      4KB

    • memory/1680-0-0x0000000000C50000-0x0000000000CD9000-memory.dmp

      Filesize

      548KB

    • memory/1680-53-0x0000000000C50000-0x0000000000CD9000-memory.dmp

      Filesize

      548KB

    • memory/1680-46-0x0000000000C50000-0x0000000000CD9000-memory.dmp

      Filesize

      548KB

    • memory/2392-3-0x0000000001040000-0x00000000010C9000-memory.dmp

      Filesize

      548KB

    • memory/2392-106-0x0000000001040000-0x00000000010C9000-memory.dmp

      Filesize

      548KB

    • memory/2392-82-0x0000000001040000-0x00000000010C9000-memory.dmp

      Filesize

      548KB

    • memory/2392-49-0x0000000001040000-0x00000000010C9000-memory.dmp

      Filesize

      548KB

    • memory/2764-110-0x0000000036F80000-0x0000000036F90000-memory.dmp

      Filesize

      64KB

    • memory/2764-47-0x000007FEBDDF0000-0x000007FEBDE00000-memory.dmp

      Filesize

      64KB

    • memory/2764-30-0x0000000000060000-0x0000000000123000-memory.dmp

      Filesize

      780KB

    • memory/2764-126-0x0000000001F00000-0x0000000001F10000-memory.dmp

      Filesize

      64KB

    • memory/2764-124-0x0000000001F00000-0x0000000001F01000-memory.dmp

      Filesize

      4KB

    • memory/2764-122-0x0000000003790000-0x0000000003830000-memory.dmp

      Filesize

      640KB

    • memory/2764-121-0x0000000001F00000-0x0000000001F01000-memory.dmp

      Filesize

      4KB

    • memory/2764-119-0x0000000003790000-0x0000000003830000-memory.dmp

      Filesize

      640KB

    • memory/2764-120-0x0000000001F20000-0x0000000001F2F000-memory.dmp

      Filesize

      60KB

    • memory/2764-118-0x00000000007E0000-0x00000000007E3000-memory.dmp

      Filesize

      12KB

    • memory/2764-117-0x0000000001F00000-0x0000000001F01000-memory.dmp

      Filesize

      4KB

    • memory/2764-116-0x0000000001F00000-0x0000000001F01000-memory.dmp

      Filesize

      4KB

    • memory/2764-115-0x0000000000450000-0x000000000051B000-memory.dmp

      Filesize

      812KB

    • memory/2764-114-0x0000000000450000-0x000000000051B000-memory.dmp

      Filesize

      812KB

    • memory/2764-112-0x00000000007E0000-0x00000000007E3000-memory.dmp

      Filesize

      12KB

    • memory/2764-48-0x0000000000450000-0x000000000051B000-memory.dmp

      Filesize

      812KB

    • memory/2764-43-0x0000000000450000-0x000000000051B000-memory.dmp

      Filesize

      812KB

    • memory/2764-44-0x0000000000450000-0x000000000051B000-memory.dmp

      Filesize

      812KB

    • memory/2764-42-0x00000000001E0000-0x00000000001E3000-memory.dmp

      Filesize

      12KB

    • memory/2764-38-0x00000000001E0000-0x00000000001E3000-memory.dmp

      Filesize

      12KB

    • memory/2764-32-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

    • memory/2764-179-0x0000000001F00000-0x0000000001F01000-memory.dmp

      Filesize

      4KB