Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 16:25

General

  • Target

    NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe

  • Size

    479KB

  • MD5

    9851a2d1286ff5b49c70df955455f307

  • SHA1

    72fcb74da7ef60348112ab39704440d9c2cd28c7

  • SHA256

    04a420cf0f6b299c574f027b6647fdde90ebf3b767ac74bf367a94f5d84c5863

  • SHA512

    6d2cc11833a1c64a2151343491990d115555dc5e4e3dd8ed5d62bce4c30097d20e1f78b524ccae7e99d6fac91aa8b3c9f4cf8a63f3906e9005efafd82ab484ad

  • SSDEEP

    12288:aVlc87eqqV5e+wBV6O+b2ejjE0n5cS1fGyZrQ6K:aVSqqHeVBxgD0Q1fGyZk6K

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9851a2d1286ff5b49c70df955455f307_JC.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1600
      • C:\Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe
        "C:\Users\Admin\AppData\Roaming\Searcont"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2412
        • C:\Users\Admin\AppData\Local\Temp\~A40C.tmp
          1212 490504 2412 1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2120
  • C:\Windows\SysWOW64\Dispelog.exe
    C:\Windows\SysWOW64\Dispelog.exe -s
    1⤵
    • Executes dropped EXE
    PID:2764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~A40C.tmp

    Filesize

    8KB

    MD5

    86dc243576cf5c7445451af37631eea9

    SHA1

    99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

    SHA256

    25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

    SHA512

    c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

  • C:\Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe

    Filesize

    479KB

    MD5

    096cbc5438f5277e6398888cbcd966e3

    SHA1

    6f4c95f883d0e1efa48bf649bbb0a00135fbc271

    SHA256

    1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

    SHA512

    30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

  • C:\Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe

    Filesize

    479KB

    MD5

    096cbc5438f5277e6398888cbcd966e3

    SHA1

    6f4c95f883d0e1efa48bf649bbb0a00135fbc271

    SHA256

    1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

    SHA512

    30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

  • C:\Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe

    Filesize

    479KB

    MD5

    096cbc5438f5277e6398888cbcd966e3

    SHA1

    6f4c95f883d0e1efa48bf649bbb0a00135fbc271

    SHA256

    1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

    SHA512

    30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

  • C:\Windows\SysWOW64\Dispelog.exe

    Filesize

    479KB

    MD5

    096cbc5438f5277e6398888cbcd966e3

    SHA1

    6f4c95f883d0e1efa48bf649bbb0a00135fbc271

    SHA256

    1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

    SHA512

    30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

  • C:\Windows\SysWOW64\Dispelog.exe

    Filesize

    479KB

    MD5

    096cbc5438f5277e6398888cbcd966e3

    SHA1

    6f4c95f883d0e1efa48bf649bbb0a00135fbc271

    SHA256

    1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

    SHA512

    30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

  • \Users\Admin\AppData\Local\Temp\~A40C.tmp

    Filesize

    8KB

    MD5

    86dc243576cf5c7445451af37631eea9

    SHA1

    99a81c47c4c02f32c0ab456bfa23c306c7a09bf9

    SHA256

    25d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a

    SHA512

    c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4

  • \Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe

    Filesize

    479KB

    MD5

    096cbc5438f5277e6398888cbcd966e3

    SHA1

    6f4c95f883d0e1efa48bf649bbb0a00135fbc271

    SHA256

    1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

    SHA512

    30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

  • \Users\Admin\AppData\Roaming\Searcont\ktmuocom.exe

    Filesize

    479KB

    MD5

    096cbc5438f5277e6398888cbcd966e3

    SHA1

    6f4c95f883d0e1efa48bf649bbb0a00135fbc271

    SHA256

    1c9ddcf954d96e6bb3530044cfcfab480f804ed6ddc5cf56cf00bcfc38205ea1

    SHA512

    30f32b367805c243d24018ac9ec841afc2dfaa34a901251b70034f01ace0435458b5df02a7299276eb5b8fff416eec24ff5bb55181ad3d6b38f2b40d74bf58b6

  • memory/1212-21-0x0000000003B00000-0x0000000003B87000-memory.dmp

    Filesize

    540KB

  • memory/1212-29-0x0000000002B40000-0x0000000002B4D000-memory.dmp

    Filesize

    52KB

  • memory/1212-24-0x0000000003B00000-0x0000000003B87000-memory.dmp

    Filesize

    540KB

  • memory/1212-26-0x0000000002B30000-0x0000000002B36000-memory.dmp

    Filesize

    24KB

  • memory/1212-22-0x0000000003B00000-0x0000000003B87000-memory.dmp

    Filesize

    540KB

  • memory/1600-5-0x0000000000490000-0x0000000000512000-memory.dmp

    Filesize

    520KB

  • memory/1600-0-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/1600-11-0x0000000000490000-0x0000000000512000-memory.dmp

    Filesize

    520KB

  • memory/1600-33-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/1600-1-0x00000000002D0000-0x0000000000350000-memory.dmp

    Filesize

    512KB

  • memory/2412-17-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2412-15-0x0000000000500000-0x0000000000580000-memory.dmp

    Filesize

    512KB

  • memory/2412-16-0x00000000001D0000-0x00000000001D5000-memory.dmp

    Filesize

    20KB

  • memory/2764-35-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2764-36-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB