Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 11:46
Static task
static1
Behavioral task
behavioral1
Sample
c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe
Resource
win10v2004-20230915-en
General
-
Target
c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe
-
Size
2.9MB
-
MD5
87b155e131e4c7b033a230b0e595f48c
-
SHA1
b643fef8715d8d2610c04550522797a71208baaf
-
SHA256
c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e
-
SHA512
588f19de53ed7096b278b2dfc745d08479472b9b6afef64a12c9ad4ea23eb56b7153be333c0de2150a467f1b54780f6672e8fe0f174f361201f6fbacd7d504e6
-
SSDEEP
49152:NGjG7j2KchZxCzi2bLi8RafI6Vm19pZz3+SbxQPEPIhFlZ3Lr/+UMSqmHngXuyt2:ow2z3fX8RAVm1lzu8xQPEAhHZ7r/+2qw
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2132 is-SBV3K.tmp 2552 OSJMount.exe 2568 OSJMount.exe -
Loads dropped DLL 5 IoCs
pid Process 1396 c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe 2132 is-SBV3K.tmp 2132 is-SBV3K.tmp 2132 is-SBV3K.tmp 2132 is-SBV3K.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files (x86)\OSJMount\unins000.dat is-SBV3K.tmp File created C:\Program Files (x86)\OSJMount\is-KGDPD.tmp is-SBV3K.tmp File created C:\Program Files (x86)\OSJMount\is-5T9MM.tmp is-SBV3K.tmp File created C:\Program Files (x86)\OSJMount\is-DCI25.tmp is-SBV3K.tmp File opened for modification C:\Program Files (x86)\OSJMount\unins000.dat is-SBV3K.tmp File created C:\Program Files (x86)\OSJMount\is-NUQBO.tmp is-SBV3K.tmp File created C:\Program Files (x86)\OSJMount\is-BOJ0T.tmp is-SBV3K.tmp File created C:\Program Files (x86)\OSJMount\is-MOHKT.tmp is-SBV3K.tmp File opened for modification C:\Program Files (x86)\OSJMount\OSJMount.exe is-SBV3K.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1396 wrote to memory of 2132 1396 c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe 29 PID 1396 wrote to memory of 2132 1396 c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe 29 PID 1396 wrote to memory of 2132 1396 c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe 29 PID 1396 wrote to memory of 2132 1396 c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe 29 PID 1396 wrote to memory of 2132 1396 c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe 29 PID 1396 wrote to memory of 2132 1396 c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe 29 PID 1396 wrote to memory of 2132 1396 c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe 29 PID 2132 wrote to memory of 2080 2132 is-SBV3K.tmp 30 PID 2132 wrote to memory of 2080 2132 is-SBV3K.tmp 30 PID 2132 wrote to memory of 2080 2132 is-SBV3K.tmp 30 PID 2132 wrote to memory of 2080 2132 is-SBV3K.tmp 30 PID 2132 wrote to memory of 2552 2132 is-SBV3K.tmp 32 PID 2132 wrote to memory of 2552 2132 is-SBV3K.tmp 32 PID 2132 wrote to memory of 2552 2132 is-SBV3K.tmp 32 PID 2132 wrote to memory of 2552 2132 is-SBV3K.tmp 32 PID 2080 wrote to memory of 1896 2080 net.exe 33 PID 2080 wrote to memory of 1896 2080 net.exe 33 PID 2080 wrote to memory of 1896 2080 net.exe 33 PID 2080 wrote to memory of 1896 2080 net.exe 33 PID 2132 wrote to memory of 2568 2132 is-SBV3K.tmp 34 PID 2132 wrote to memory of 2568 2132 is-SBV3K.tmp 34 PID 2132 wrote to memory of 2568 2132 is-SBV3K.tmp 34 PID 2132 wrote to memory of 2568 2132 is-SBV3K.tmp 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe"C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\is-7I6A3.tmp\is-SBV3K.tmp"C:\Users\Admin\AppData\Local\Temp\is-7I6A3.tmp\is-SBV3K.tmp" /SL4 $80022 "C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe" 2842060 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 273⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 274⤵PID:1896
-
-
-
C:\Program Files (x86)\OSJMount\OSJMount.exe"C:\Program Files (x86)\OSJMount\OSJMount.exe" -i3⤵
- Executes dropped EXE
PID:2552
-
-
C:\Program Files (x86)\OSJMount\OSJMount.exe"C:\Program Files (x86)\OSJMount\OSJMount.exe" -s3⤵
- Executes dropped EXE
PID:2568
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD54746eadc0a046beaf547a5c6bda5709b
SHA1adad4eacfd074ceaa7a0fdb7760346b819721b5e
SHA256a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308
SHA512e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4
-
Filesize
2.2MB
MD54746eadc0a046beaf547a5c6bda5709b
SHA1adad4eacfd074ceaa7a0fdb7760346b819721b5e
SHA256a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308
SHA512e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4
-
Filesize
2.2MB
MD54746eadc0a046beaf547a5c6bda5709b
SHA1adad4eacfd074ceaa7a0fdb7760346b819721b5e
SHA256a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308
SHA512e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4
-
Filesize
652KB
MD5f1b5055e1e80bf52a48683f85f9298ef
SHA126976cc0c690693084466d185c5e84da9870a778
SHA2560b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50
SHA51201290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef
-
Filesize
652KB
MD5f1b5055e1e80bf52a48683f85f9298ef
SHA126976cc0c690693084466d185c5e84da9870a778
SHA2560b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50
SHA51201290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef
-
Filesize
2.2MB
MD54746eadc0a046beaf547a5c6bda5709b
SHA1adad4eacfd074ceaa7a0fdb7760346b819721b5e
SHA256a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308
SHA512e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4
-
Filesize
652KB
MD5f1b5055e1e80bf52a48683f85f9298ef
SHA126976cc0c690693084466d185c5e84da9870a778
SHA2560b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50
SHA51201290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3