Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    145s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/10/2023, 18:39

General

  • Target

    da664f72a4104fdee1e72ec5f4eb624f97933b1702bc5318ef7091fed23878de.exe

  • Size

    2.9MB

  • MD5

    f6ff5840575c11cc389777febe77704e

  • SHA1

    bf54a3c152aab8d669af4554c07e7b1fbde370d1

  • SHA256

    da664f72a4104fdee1e72ec5f4eb624f97933b1702bc5318ef7091fed23878de

  • SHA512

    e57678c49afa5a2a025a68633205c4c89fdbe299375eef069134e836b61587fb8e75a0b7ce418345fa699a596a537212ed0e8a315a731248e21302770ae06b51

  • SSDEEP

    49152:mGvJS4eA33qH1XJDHQFvTqhygg6n06XjQDZlZW030ie5mZEZqK4Uq9KXsVxqi0ek:PA4eW3qVZT4v9gg606zc/gU0ie5mZ4jV

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\da664f72a4104fdee1e72ec5f4eb624f97933b1702bc5318ef7091fed23878de.exe
    "C:\Users\Admin\AppData\Local\Temp\da664f72a4104fdee1e72ec5f4eb624f97933b1702bc5318ef7091fed23878de.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4872
    • C:\Users\Admin\AppData\Local\Temp\is-LLBFR.tmp\is-JQRIS.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-LLBFR.tmp\is-JQRIS.tmp" /SL4 $70216 "C:\Users\Admin\AppData\Local\Temp\da664f72a4104fdee1e72ec5f4eb624f97933b1702bc5318ef7091fed23878de.exe" 2846236 52224
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:4200
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" helpmsg 29
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1660
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 helpmsg 29
          4⤵
            PID:204
        • C:\Program Files (x86)\OSNMount\OSNMount.exe
          "C:\Program Files (x86)\OSNMount\OSNMount.exe" -i
          3⤵
          • Executes dropped EXE
          PID:1508
        • C:\Program Files (x86)\OSNMount\OSNMount.exe
          "C:\Program Files (x86)\OSNMount\OSNMount.exe" -s
          3⤵
          • Executes dropped EXE
          PID:3672

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\OSNMount\OSNMount.exe

      Filesize

      2.3MB

      MD5

      016e672371a4716f6f7b5f14a0d22006

      SHA1

      5a1a731ec902a26a4f0bb7774e1c25451b9a0f01

      SHA256

      1328eb253044694b17d4343f4eb000c95a7bfb0c478bc315eec842e7f7a2d8bc

      SHA512

      7dfceeb44a7d2a7e6c918bffd4c902241ecd4a8f70c81ad0d2fe31a91f05161c25229aafef40c153e13910b0ee4c9214126bd673472bac07ffb2e29668df5110

    • C:\Program Files (x86)\OSNMount\OSNMount.exe

      Filesize

      2.3MB

      MD5

      016e672371a4716f6f7b5f14a0d22006

      SHA1

      5a1a731ec902a26a4f0bb7774e1c25451b9a0f01

      SHA256

      1328eb253044694b17d4343f4eb000c95a7bfb0c478bc315eec842e7f7a2d8bc

      SHA512

      7dfceeb44a7d2a7e6c918bffd4c902241ecd4a8f70c81ad0d2fe31a91f05161c25229aafef40c153e13910b0ee4c9214126bd673472bac07ffb2e29668df5110

    • C:\Program Files (x86)\OSNMount\OSNMount.exe

      Filesize

      2.3MB

      MD5

      016e672371a4716f6f7b5f14a0d22006

      SHA1

      5a1a731ec902a26a4f0bb7774e1c25451b9a0f01

      SHA256

      1328eb253044694b17d4343f4eb000c95a7bfb0c478bc315eec842e7f7a2d8bc

      SHA512

      7dfceeb44a7d2a7e6c918bffd4c902241ecd4a8f70c81ad0d2fe31a91f05161c25229aafef40c153e13910b0ee4c9214126bd673472bac07ffb2e29668df5110

    • C:\Users\Admin\AppData\Local\Temp\is-LLBFR.tmp\is-JQRIS.tmp

      Filesize

      652KB

      MD5

      f1b5055e1e80bf52a48683f85f9298ef

      SHA1

      26976cc0c690693084466d185c5e84da9870a778

      SHA256

      0b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50

      SHA512

      01290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef

    • C:\Users\Admin\AppData\Local\Temp\is-LLBFR.tmp\is-JQRIS.tmp

      Filesize

      652KB

      MD5

      f1b5055e1e80bf52a48683f85f9298ef

      SHA1

      26976cc0c690693084466d185c5e84da9870a778

      SHA256

      0b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50

      SHA512

      01290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef

    • \Users\Admin\AppData\Local\Temp\is-F3468.tmp\_isetup\_iscrypt.dll

      Filesize

      2KB

      MD5

      a69559718ab506675e907fe49deb71e9

      SHA1

      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

      SHA256

      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

      SHA512

      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

    • memory/1508-38-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/1508-33-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/1508-34-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/1508-37-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-49-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-75-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-41-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-91-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-87-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-84-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-81-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-52-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-55-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-58-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-61-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-64-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-66-0x0000000000960000-0x00000000009A9000-memory.dmp

      Filesize

      292KB

    • memory/3672-65-0x0000000000960000-0x00000000009A9000-memory.dmp

      Filesize

      292KB

    • memory/3672-71-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/3672-72-0x0000000000960000-0x00000000009A9000-memory.dmp

      Filesize

      292KB

    • memory/3672-78-0x0000000000400000-0x000000000064D000-memory.dmp

      Filesize

      2.3MB

    • memory/4200-7-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB

    • memory/4200-45-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/4200-43-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB

    • memory/4872-1-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/4872-42-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB