Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 23:55

General

  • Target

    39479abc333ad1ba0b7cef2ba6c385e354be3cb787328503e630353a7b050f10.exe

  • Size

    1.1MB

  • MD5

    583d37942faedf8e44bd1a1878a560fc

  • SHA1

    0dbf4cb93e0ad0721b048fbde62bbb137646b5a4

  • SHA256

    39479abc333ad1ba0b7cef2ba6c385e354be3cb787328503e630353a7b050f10

  • SHA512

    2b73d599d8fcb0fe0fb38befdc276b0e34e3b04b6c0bcee012af5cfb6db4d26c1e9872bad77c7241b98d81442f72c5e08e8732cf5ed9227b026c4702e0b0181c

  • SSDEEP

    24576:VU3x9NhM3GOIeNfseZL9R2sXTFA+G64jrl80n0GXfeaai:Vw7M3GOIaBZL9R2sXTF9/4jrl80nlzai

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39479abc333ad1ba0b7cef2ba6c385e354be3cb787328503e630353a7b050f10.exe
    "C:\Users\Admin\AppData\Local\Temp\39479abc333ad1ba0b7cef2ba6c385e354be3cb787328503e630353a7b050f10.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Windows\system32\cmd.exe
      cmd /c mkdir C:\ProgramData\YxKBUo3XvkFZP7p
      2⤵
        PID:2364
      • C:\Windows\system32\cmd.exe
        cmd /c C:\ProgramData\YxKBUo3XvkFZP7p\MpLxDcE17.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1420
        • C:\ProgramData\YxKBUo3XvkFZP7p\MpLxDcE17.exe
          C:\ProgramData\YxKBUo3XvkFZP7p\MpLxDcE17.exe
          3⤵
          • Adds policy Run key to start application
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: CmdExeWriteProcessMemorySpam
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2724

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\YxKBUo3XvkFZP7p\MSVCR100.dll

      Filesize

      755KB

      MD5

      bf38660a9125935658cfa3e53fdc7d65

      SHA1

      0b51fb415ec89848f339f8989d323bea722bfd70

      SHA256

      60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

      SHA512

      25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

    • C:\ProgramData\YxKBUo3XvkFZP7p\MpLxDcE17.exe

      Filesize

      16KB

      MD5

      973b4b2658796840ad6ff9ac1cb21383

      SHA1

      2ae4808a1d7e450707a9f928ea13cd73e5040431

      SHA256

      f671045566c60930dc459aa30e2bb38f25525e670bf72f7b69c1f918ae3d9565

      SHA512

      42e313fae2f84c6ecc7b5c2c4178bcbcf3043fd239d9b05f5614b64e2d8841a7fe54a0786c1b5752bb1b54079b9873d6ade63e7b00cb4118a007d3d0360d6b4c

    • C:\ProgramData\YxKBUo3XvkFZP7p\MpLxDcE17.exe

      Filesize

      16KB

      MD5

      973b4b2658796840ad6ff9ac1cb21383

      SHA1

      2ae4808a1d7e450707a9f928ea13cd73e5040431

      SHA256

      f671045566c60930dc459aa30e2bb38f25525e670bf72f7b69c1f918ae3d9565

      SHA512

      42e313fae2f84c6ecc7b5c2c4178bcbcf3043fd239d9b05f5614b64e2d8841a7fe54a0786c1b5752bb1b54079b9873d6ade63e7b00cb4118a007d3d0360d6b4c

    • C:\ProgramData\YxKBUo3XvkFZP7p\MpLxDcE17.txt

      Filesize

      915B

      MD5

      46868fa44781a501088586680694e1be

      SHA1

      f58776e05884daab122a0a7ad17d1b0485b637d3

      SHA256

      bd4873230364fb5e8f14d68368b98b403713530a1b7e94bac070205b2262e7e6

      SHA512

      39e61b6f7bfdfc87097a5326f1f33a81fcac5871ea485a72cb461dc744b31dd603c3cd68d24a2f9c8671144f7a26c408722ad20aa71fb76a0e81ef0917c0e423

    • C:\ProgramData\YxKBUo3XvkFZP7p\jli.dll

      Filesize

      604KB

      MD5

      41c0881a2ed7e8f264b6fb150c71fb68

      SHA1

      e7d2dcf5361a3863ebbc3a9144abc782ff34dc7c

      SHA256

      073031b8844a870a00c4edff435e4025e18f30912cc0b22dd31196666f5b1aa6

      SHA512

      b8ef5dbbb502d0cf78de5dcfdadf818c5ecc59706f0c57a3830a5c61d154ac78be72a9f821777156749572e223dd072c732d69bf621b669b7406d73decc25959

    • \ProgramData\YxKBUo3XvkFZP7p\jli.dll

      Filesize

      604KB

      MD5

      41c0881a2ed7e8f264b6fb150c71fb68

      SHA1

      e7d2dcf5361a3863ebbc3a9144abc782ff34dc7c

      SHA256

      073031b8844a870a00c4edff435e4025e18f30912cc0b22dd31196666f5b1aa6

      SHA512

      b8ef5dbbb502d0cf78de5dcfdadf818c5ecc59706f0c57a3830a5c61d154ac78be72a9f821777156749572e223dd072c732d69bf621b669b7406d73decc25959

    • \ProgramData\YxKBUo3XvkFZP7p\msvcr100.dll

      Filesize

      755KB

      MD5

      bf38660a9125935658cfa3e53fdc7d65

      SHA1

      0b51fb415ec89848f339f8989d323bea722bfd70

      SHA256

      60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

      SHA512

      25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

    • memory/2328-1-0x000000013F4D0000-0x000000013F708000-memory.dmp

      Filesize

      2.2MB

    • memory/2328-6-0x000000013F4D0000-0x000000013F708000-memory.dmp

      Filesize

      2.2MB

    • memory/2328-0-0x000000013F4D0000-0x000000013F708000-memory.dmp

      Filesize

      2.2MB

    • memory/2724-20-0x0000000002090000-0x0000000002177000-memory.dmp

      Filesize

      924KB

    • memory/2724-29-0x0000000002DA0000-0x0000000002E39000-memory.dmp

      Filesize

      612KB

    • memory/2724-15-0x0000000002090000-0x0000000002177000-memory.dmp

      Filesize

      924KB

    • memory/2724-17-0x0000000002090000-0x0000000002177000-memory.dmp

      Filesize

      924KB

    • memory/2724-18-0x0000000002090000-0x0000000002177000-memory.dmp

      Filesize

      924KB

    • memory/2724-19-0x0000000002090000-0x0000000002177000-memory.dmp

      Filesize

      924KB

    • memory/2724-13-0x0000000000150000-0x0000000000151000-memory.dmp

      Filesize

      4KB

    • memory/2724-21-0x00000000035E0000-0x00000000037F1000-memory.dmp

      Filesize

      2.1MB

    • memory/2724-25-0x0000000002670000-0x00000000026C6000-memory.dmp

      Filesize

      344KB

    • memory/2724-26-0x0000000002F30000-0x000000000301B000-memory.dmp

      Filesize

      940KB

    • memory/2724-27-0x0000000002F30000-0x000000000301B000-memory.dmp

      Filesize

      940KB

    • memory/2724-14-0x0000000002090000-0x0000000002177000-memory.dmp

      Filesize

      924KB

    • memory/2724-30-0x0000000003B30000-0x0000000003CA5000-memory.dmp

      Filesize

      1.5MB

    • memory/2724-31-0x0000000003B30000-0x0000000003CA5000-memory.dmp

      Filesize

      1.5MB

    • memory/2724-33-0x00000000032D0000-0x0000000003322000-memory.dmp

      Filesize

      328KB

    • memory/2724-35-0x0000000000200000-0x0000000000201000-memory.dmp

      Filesize

      4KB

    • memory/2724-34-0x00000000004B0000-0x00000000004B1000-memory.dmp

      Filesize

      4KB

    • memory/2724-36-0x00000000035E0000-0x00000000037F1000-memory.dmp

      Filesize

      2.1MB

    • memory/2724-37-0x0000000002670000-0x00000000026C6000-memory.dmp

      Filesize

      344KB

    • memory/2724-38-0x0000000002F30000-0x000000000301B000-memory.dmp

      Filesize

      940KB

    • memory/2724-39-0x0000000002DA0000-0x0000000002E39000-memory.dmp

      Filesize

      612KB

    • memory/2724-40-0x0000000003B30000-0x0000000003CA5000-memory.dmp

      Filesize

      1.5MB

    • memory/2724-41-0x00000000032D0000-0x0000000003322000-memory.dmp

      Filesize

      328KB

    • memory/2724-42-0x00000000032D0000-0x0000000003322000-memory.dmp

      Filesize

      328KB