Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 11:46

General

  • Target

    c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe

  • Size

    2.9MB

  • MD5

    87b155e131e4c7b033a230b0e595f48c

  • SHA1

    b643fef8715d8d2610c04550522797a71208baaf

  • SHA256

    c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e

  • SHA512

    588f19de53ed7096b278b2dfc745d08479472b9b6afef64a12c9ad4ea23eb56b7153be333c0de2150a467f1b54780f6672e8fe0f174f361201f6fbacd7d504e6

  • SSDEEP

    49152:NGjG7j2KchZxCzi2bLi8RafI6Vm19pZz3+SbxQPEPIhFlZ3Lr/+UMSqmHngXuyt2:ow2z3fX8RAVm1lzu8xQPEAhHZ7r/+2qw

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe
    "C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Users\Admin\AppData\Local\Temp\is-7I6A3.tmp\is-SBV3K.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7I6A3.tmp\is-SBV3K.tmp" /SL4 $80022 "C:\Users\Admin\AppData\Local\Temp\c8afae38821912b58591731a4198e4dd6d93cf5bd361152412189655afb29a8e.exe" 2842060 52224
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" helpmsg 27
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2080
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 helpmsg 27
          4⤵
            PID:1896
        • C:\Program Files (x86)\OSJMount\OSJMount.exe
          "C:\Program Files (x86)\OSJMount\OSJMount.exe" -i
          3⤵
          • Executes dropped EXE
          PID:2552
        • C:\Program Files (x86)\OSJMount\OSJMount.exe
          "C:\Program Files (x86)\OSJMount\OSJMount.exe" -s
          3⤵
          • Executes dropped EXE
          PID:2568

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\OSJMount\OSJMount.exe

      Filesize

      2.2MB

      MD5

      4746eadc0a046beaf547a5c6bda5709b

      SHA1

      adad4eacfd074ceaa7a0fdb7760346b819721b5e

      SHA256

      a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308

      SHA512

      e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4

    • C:\Program Files (x86)\OSJMount\OSJMount.exe

      Filesize

      2.2MB

      MD5

      4746eadc0a046beaf547a5c6bda5709b

      SHA1

      adad4eacfd074ceaa7a0fdb7760346b819721b5e

      SHA256

      a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308

      SHA512

      e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4

    • C:\Program Files (x86)\OSJMount\OSJMount.exe

      Filesize

      2.2MB

      MD5

      4746eadc0a046beaf547a5c6bda5709b

      SHA1

      adad4eacfd074ceaa7a0fdb7760346b819721b5e

      SHA256

      a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308

      SHA512

      e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4

    • C:\Users\Admin\AppData\Local\Temp\is-7I6A3.tmp\is-SBV3K.tmp

      Filesize

      652KB

      MD5

      f1b5055e1e80bf52a48683f85f9298ef

      SHA1

      26976cc0c690693084466d185c5e84da9870a778

      SHA256

      0b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50

      SHA512

      01290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef

    • C:\Users\Admin\AppData\Local\Temp\is-7I6A3.tmp\is-SBV3K.tmp

      Filesize

      652KB

      MD5

      f1b5055e1e80bf52a48683f85f9298ef

      SHA1

      26976cc0c690693084466d185c5e84da9870a778

      SHA256

      0b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50

      SHA512

      01290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef

    • \Program Files (x86)\OSJMount\OSJMount.exe

      Filesize

      2.2MB

      MD5

      4746eadc0a046beaf547a5c6bda5709b

      SHA1

      adad4eacfd074ceaa7a0fdb7760346b819721b5e

      SHA256

      a171cd99b430ef890b625b53a0378693ae2014ff3d150e65f3bad367d8f84308

      SHA512

      e72ff48686028a4136d1e206c9db78e6b1050526c4bdfdb3f8b56a6fb341d37bbdfbc91dbbd8df0c379aa56b5351ce464842d568d70ff69f7b9dba29eb970df4

    • \Users\Admin\AppData\Local\Temp\is-7I6A3.tmp\is-SBV3K.tmp

      Filesize

      652KB

      MD5

      f1b5055e1e80bf52a48683f85f9298ef

      SHA1

      26976cc0c690693084466d185c5e84da9870a778

      SHA256

      0b6381a1fc1ebc6594804042c8bf1ccfac7a9328bba3d3a487e571cbee298e50

      SHA512

      01290db6ac4dedb15d20fdc80a112b34cbce5c381c8fd262633c662e7927b314bca8063ad6109331d57feb50ed4045c05a7235347bb29edf401f9f867e9237ef

    • \Users\Admin\AppData\Local\Temp\is-HLEKL.tmp\_isetup\_iscrypt.dll

      Filesize

      2KB

      MD5

      a69559718ab506675e907fe49deb71e9

      SHA1

      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

      SHA256

      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

      SHA512

      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

    • \Users\Admin\AppData\Local\Temp\is-HLEKL.tmp\_isetup\_shfoldr.dll

      Filesize

      22KB

      MD5

      92dc6ef532fbb4a5c3201469a5b5eb63

      SHA1

      3e89ff837147c16b4e41c30d6c796374e0b8e62c

      SHA256

      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

      SHA512

      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    • \Users\Admin\AppData\Local\Temp\is-HLEKL.tmp\_isetup\_shfoldr.dll

      Filesize

      22KB

      MD5

      92dc6ef532fbb4a5c3201469a5b5eb63

      SHA1

      3e89ff837147c16b4e41c30d6c796374e0b8e62c

      SHA256

      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

      SHA512

      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

    • memory/1396-1-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/1396-44-0x0000000000400000-0x0000000000413000-memory.dmp

      Filesize

      76KB

    • memory/2132-48-0x0000000003A80000-0x0000000003CBC000-memory.dmp

      Filesize

      2.2MB

    • memory/2132-45-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/2132-47-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/2132-37-0x0000000003A80000-0x0000000003CBC000-memory.dmp

      Filesize

      2.2MB

    • memory/2132-8-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/2552-42-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2552-40-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2552-39-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2552-49-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2552-51-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-66-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-78-0x00000000020A0000-0x00000000020E9000-memory.dmp

      Filesize

      292KB

    • memory/2568-63-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-54-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-69-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-72-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-75-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-60-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-79-0x00000000020A0000-0x00000000020E9000-memory.dmp

      Filesize

      292KB

    • memory/2568-83-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-86-0x00000000020A0000-0x00000000020E9000-memory.dmp

      Filesize

      292KB

    • memory/2568-87-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-90-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-93-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-96-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB

    • memory/2568-99-0x0000000000400000-0x000000000063C000-memory.dmp

      Filesize

      2.2MB