Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 10:40

General

  • Target

    36f66b4a07a3e1caadb2935a51db3284bca379fac7d4d24abc39994949a8bef9.exe

  • Size

    1.4MB

  • MD5

    c3a778773d111438753b04f1fdd1c015

  • SHA1

    178ed102913cb579e567aa3e80ed1638e37b93d0

  • SHA256

    36f66b4a07a3e1caadb2935a51db3284bca379fac7d4d24abc39994949a8bef9

  • SHA512

    a8b081ef60acb557e9973b26f7e7e999421283c3008770c67128400cec0fb819999e9e0aad9a494eea8bda8121fa9d8b5a24a1372ffa6d06f1c22d11f1edc6bd

  • SSDEEP

    12288:DSvO2x9mONvKRhLSFROkx2LIaCy+Bg0tmyyyI:2vO2xJKRh2bOkx2LFV+Bg6M

Score
10/10
upx

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:424
      • C:\Program Files\finger.exe
        "C:\Program Files\finger.exe"
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2832
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1268
      • C:\Users\Admin\AppData\Local\Temp\36f66b4a07a3e1caadb2935a51db3284bca379fac7d4d24abc39994949a8bef9.exe
        "C:\Users\Admin\AppData\Local\Temp\36f66b4a07a3e1caadb2935a51db3284bca379fac7d4d24abc39994949a8bef9.exe"
        2⤵
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\36f66b4a07a3e1caadb2935a51db3284bca379fac7d4d24abc39994949a8bef9.exe"
          3⤵
          • Deletes itself
          • Suspicious use of WriteProcessMemory
          PID:2976
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 1
            4⤵
            • Delays execution with timeout.exe
            PID:2844
    • C:\Windows\Syswow64\20423910
      C:\Windows\Syswow64\20423910
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Windows\Syswow64\20423910"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2168
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 1
          3⤵
          • Delays execution with timeout.exe
          PID:1220

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\finger.exe

      Filesize

      11KB

      MD5

      c19ad632b95e9d78384166ba76f47ebb

      SHA1

      73be604b616e2bf9afa032b80ad480b16401be7a

      SHA256

      9e1be0cef21da54f815e49e97ff378c7b894cb4ccbf9407e2f629c1879aad6a1

      SHA512

      9f896182654d6fcab429255f358ff4f9ee914ea53dace01fee873988f20baeca5f832329f76a3ab29000664218a82552343d8dccffc646b46bd26a14fc183758

    • C:\Users\Admin\AppData\Local\Temp\a190ce1c.tmp

      Filesize

      11.6MB

      MD5

      5244c87dbafa1f764b258766005dea73

      SHA1

      84cb8b4fb3e0910cfecfb31b6fa54c16d940e703

      SHA256

      077035f93ddc3ac5a8b5631d43826baf7722256eb1c4716b3c2567f07379bc40

      SHA512

      54d64d32e73e2752cdf9a110db17ad64574eb072df0ed0dc34a7e4bc469c03aa79ef7d45465e279ef85d5fc6b33a1b750b181476cdea7ea98898ddba9aa60438

    • C:\Windows\SysWOW64\20423910

      Filesize

      1.4MB

      MD5

      573b42b75826cdc22e426796550f1611

      SHA1

      4154e5d8567d65340e0bb13cc203343a7d15740e

      SHA256

      0a7d7c6f1b540ec5492298d96674360cc12b720ce879fdd13ce50f34b47e77c2

      SHA512

      ecb05a941b223a3cb13b78746436b3c60ab5ed9fa390b4afad68488984adc47e487d629b266be9db1866badaa51db7732baf87e98a56eb791bc54e74baff687c

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      61KB

      MD5

      f3441b8572aae8801c04f3060b550443

      SHA1

      4ef0a35436125d6821831ef36c28ffaf196cda15

      SHA256

      6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

      SHA512

      5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    • C:\Windows\Syswow64\20423910

      Filesize

      1.4MB

      MD5

      573b42b75826cdc22e426796550f1611

      SHA1

      4154e5d8567d65340e0bb13cc203343a7d15740e

      SHA256

      0a7d7c6f1b540ec5492298d96674360cc12b720ce879fdd13ce50f34b47e77c2

      SHA512

      ecb05a941b223a3cb13b78746436b3c60ab5ed9fa390b4afad68488984adc47e487d629b266be9db1866badaa51db7732baf87e98a56eb791bc54e74baff687c

    • \Program Files\finger.exe

      Filesize

      11KB

      MD5

      c19ad632b95e9d78384166ba76f47ebb

      SHA1

      73be604b616e2bf9afa032b80ad480b16401be7a

      SHA256

      9e1be0cef21da54f815e49e97ff378c7b894cb4ccbf9407e2f629c1879aad6a1

      SHA512

      9f896182654d6fcab429255f358ff4f9ee914ea53dace01fee873988f20baeca5f832329f76a3ab29000664218a82552343d8dccffc646b46bd26a14fc183758

    • memory/424-47-0x0000000000880000-0x00000000008A8000-memory.dmp

      Filesize

      160KB

    • memory/1268-26-0x0000000006A30000-0x0000000006B29000-memory.dmp

      Filesize

      996KB

    • memory/1268-27-0x0000000006A30000-0x0000000006B29000-memory.dmp

      Filesize

      996KB

    • memory/1268-25-0x0000000002150000-0x0000000002153000-memory.dmp

      Filesize

      12KB

    • memory/1268-50-0x0000000006A30000-0x0000000006B29000-memory.dmp

      Filesize

      996KB

    • memory/1268-23-0x0000000002150000-0x0000000002153000-memory.dmp

      Filesize

      12KB

    • memory/2472-0-0x00000000011A0000-0x000000000122C000-memory.dmp

      Filesize

      560KB

    • memory/2472-51-0x00000000011A0000-0x000000000122C000-memory.dmp

      Filesize

      560KB

    • memory/2472-19-0x00000000011A0000-0x000000000122C000-memory.dmp

      Filesize

      560KB

    • memory/2832-44-0x000007FEBE010000-0x000007FEBE020000-memory.dmp

      Filesize

      64KB

    • memory/2832-104-0x0000000037930000-0x0000000037940000-memory.dmp

      Filesize

      64KB

    • memory/2832-43-0x00000000003C0000-0x000000000048B000-memory.dmp

      Filesize

      812KB

    • memory/2832-41-0x00000000003C0000-0x000000000048B000-memory.dmp

      Filesize

      812KB

    • memory/2832-39-0x0000000000090000-0x0000000000093000-memory.dmp

      Filesize

      12KB

    • memory/2832-36-0x0000000000090000-0x0000000000093000-memory.dmp

      Filesize

      12KB

    • memory/2832-33-0x0000000000060000-0x0000000000061000-memory.dmp

      Filesize

      4KB

    • memory/2832-58-0x00000000003C0000-0x000000000048B000-memory.dmp

      Filesize

      812KB

    • memory/2832-31-0x0000000000140000-0x0000000000203000-memory.dmp

      Filesize

      780KB

    • memory/2832-116-0x0000000000720000-0x0000000000721000-memory.dmp

      Filesize

      4KB

    • memory/2832-115-0x00000000043F0000-0x00000000045B5000-memory.dmp

      Filesize

      1.8MB

    • memory/2832-40-0x00000000003C0000-0x000000000048B000-memory.dmp

      Filesize

      812KB

    • memory/2832-106-0x0000000000880000-0x00000000008A8000-memory.dmp

      Filesize

      160KB

    • memory/2832-107-0x0000000000730000-0x0000000000731000-memory.dmp

      Filesize

      4KB

    • memory/2832-108-0x0000000000880000-0x00000000008A8000-memory.dmp

      Filesize

      160KB

    • memory/2832-109-0x0000000000740000-0x0000000000741000-memory.dmp

      Filesize

      4KB

    • memory/2832-110-0x0000000000730000-0x0000000000731000-memory.dmp

      Filesize

      4KB

    • memory/2832-111-0x00000000043F0000-0x00000000045B5000-memory.dmp

      Filesize

      1.8MB

    • memory/2832-112-0x0000000000740000-0x0000000000741000-memory.dmp

      Filesize

      4KB

    • memory/2832-113-0x0000000000730000-0x0000000000731000-memory.dmp

      Filesize

      4KB

    • memory/2832-114-0x0000000000730000-0x0000000000731000-memory.dmp

      Filesize

      4KB

    • memory/3060-20-0x00000000002E0000-0x000000000036C000-memory.dmp

      Filesize

      560KB

    • memory/3060-80-0x00000000002E0000-0x000000000036C000-memory.dmp

      Filesize

      560KB

    • memory/3060-3-0x00000000002E0000-0x000000000036C000-memory.dmp

      Filesize

      560KB