Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    161s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 20:23

General

  • Target

    NEAS.4e563d84c6b217afe7c56add4dd84d60.exe

  • Size

    70KB

  • MD5

    4e563d84c6b217afe7c56add4dd84d60

  • SHA1

    641d2fbc97225ffbd65d83cb73094316ba2547e2

  • SHA256

    191ea4a15f344e7f68660ed1fac5494f0467f27fb2c02d62620631fc66cc4c50

  • SHA512

    0e7818f64007a75066fe47a55f3ef04fac54f99763d1d0fc83cb122bedf20a27d8db1176e25a81f3a755fbdf13fe02c8cb8b276bc6ee3210d64ff63a63e22363

  • SSDEEP

    1536:Jq5VwWDjDkdTRqHFOn8tIbbeYiuZIFS9b1YTjipvF2a:Jq5ud9qHFO8Kf3rIIb1YvQd2a

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.4e563d84c6b217afe7c56add4dd84d60.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4e563d84c6b217afe7c56add4dd84d60.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    0ff6faee356d2688d5e2679074378a01

    SHA1

    9ac36121d5d6727dd972a41702fc63042fa95f61

    SHA256

    230ab0c6454f1bb9220d34dab56ad4aafb8942e91256bd2f7e8a7b97c57d1d8e

    SHA512

    9204187e28ee654b65f768d82ec478a0e90042dd7a0fb0de5a7ef9658f1c2c13554f1dd1abcc4c2401061e42ead44db4a41c0b86a61fad367990cfa765c8ae05

  • C:\Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    0ff6faee356d2688d5e2679074378a01

    SHA1

    9ac36121d5d6727dd972a41702fc63042fa95f61

    SHA256

    230ab0c6454f1bb9220d34dab56ad4aafb8942e91256bd2f7e8a7b97c57d1d8e

    SHA512

    9204187e28ee654b65f768d82ec478a0e90042dd7a0fb0de5a7ef9658f1c2c13554f1dd1abcc4c2401061e42ead44db4a41c0b86a61fad367990cfa765c8ae05

  • C:\Windows\SysWOW64\grcopy.dll

    Filesize

    70KB

    MD5

    c1da20dd927c85f9ae197701cb903c7c

    SHA1

    53c8b981a6ecb5fdcf9310daead5ce78b46c17cb

    SHA256

    fb514932c28a8894164caf59f8e5035c4d1a793b3278999f3baca2d469539751

    SHA512

    9267ce5f778175f2686b918307f47e39b46eb958ef25921bba700db9afea990efa980539a2ebbf6c3c886ea4768035e8659a8d7bd5f7e42c3f83cdbdf61adbbd

  • C:\Windows\SysWOW64\satornas.dll

    Filesize

    183B

    MD5

    16965e96e914a1d887c2b6884b32bb0f

    SHA1

    37a30b553d672c6dc8e0471d186ffc0ad7b6939f

    SHA256

    108dd1f2abac2434fdc2d6f6dcb98b220fb8d1469cb1262eebb3b87c7d0867cb

    SHA512

    5f35c3c5e96297680e83d915fc2b87f559c6c426236555d2bc02194f8492d004b9921b87995b5bfff3b7d2a7130cc5309e85e122d4038ed2239c7665c3a1b176

  • C:\Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    8907b33829d5f8c119675cc999ec730f

    SHA1

    3bbd63f7c935c02b2c38fec3d789375795f5198f

    SHA256

    f819ff70e313fcd51cb8a42c310d66135169f88655f107bd66f8703f92dad5a1

    SHA512

    bfb319f395851b7e2d0f77eec80f66a60b9015510c179ed41c6443dcb3703f5f820fae599e3a4e5ce36f67d534cbc190b771ad33a56fb585de3855108bb80d6a

  • C:\Windows\SysWOW64\smnss.exe

    Filesize

    70KB

    MD5

    c1da20dd927c85f9ae197701cb903c7c

    SHA1

    53c8b981a6ecb5fdcf9310daead5ce78b46c17cb

    SHA256

    fb514932c28a8894164caf59f8e5035c4d1a793b3278999f3baca2d469539751

    SHA512

    9267ce5f778175f2686b918307f47e39b46eb958ef25921bba700db9afea990efa980539a2ebbf6c3c886ea4768035e8659a8d7bd5f7e42c3f83cdbdf61adbbd

  • C:\Windows\SysWOW64\smnss.exe

    Filesize

    70KB

    MD5

    c1da20dd927c85f9ae197701cb903c7c

    SHA1

    53c8b981a6ecb5fdcf9310daead5ce78b46c17cb

    SHA256

    fb514932c28a8894164caf59f8e5035c4d1a793b3278999f3baca2d469539751

    SHA512

    9267ce5f778175f2686b918307f47e39b46eb958ef25921bba700db9afea990efa980539a2ebbf6c3c886ea4768035e8659a8d7bd5f7e42c3f83cdbdf61adbbd

  • \Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    0ff6faee356d2688d5e2679074378a01

    SHA1

    9ac36121d5d6727dd972a41702fc63042fa95f61

    SHA256

    230ab0c6454f1bb9220d34dab56ad4aafb8942e91256bd2f7e8a7b97c57d1d8e

    SHA512

    9204187e28ee654b65f768d82ec478a0e90042dd7a0fb0de5a7ef9658f1c2c13554f1dd1abcc4c2401061e42ead44db4a41c0b86a61fad367990cfa765c8ae05

  • \Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    0ff6faee356d2688d5e2679074378a01

    SHA1

    9ac36121d5d6727dd972a41702fc63042fa95f61

    SHA256

    230ab0c6454f1bb9220d34dab56ad4aafb8942e91256bd2f7e8a7b97c57d1d8e

    SHA512

    9204187e28ee654b65f768d82ec478a0e90042dd7a0fb0de5a7ef9658f1c2c13554f1dd1abcc4c2401061e42ead44db4a41c0b86a61fad367990cfa765c8ae05

  • \Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    8907b33829d5f8c119675cc999ec730f

    SHA1

    3bbd63f7c935c02b2c38fec3d789375795f5198f

    SHA256

    f819ff70e313fcd51cb8a42c310d66135169f88655f107bd66f8703f92dad5a1

    SHA512

    bfb319f395851b7e2d0f77eec80f66a60b9015510c179ed41c6443dcb3703f5f820fae599e3a4e5ce36f67d534cbc190b771ad33a56fb585de3855108bb80d6a

  • \Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    8907b33829d5f8c119675cc999ec730f

    SHA1

    3bbd63f7c935c02b2c38fec3d789375795f5198f

    SHA256

    f819ff70e313fcd51cb8a42c310d66135169f88655f107bd66f8703f92dad5a1

    SHA512

    bfb319f395851b7e2d0f77eec80f66a60b9015510c179ed41c6443dcb3703f5f820fae599e3a4e5ce36f67d534cbc190b771ad33a56fb585de3855108bb80d6a

  • \Windows\SysWOW64\smnss.exe

    Filesize

    70KB

    MD5

    c1da20dd927c85f9ae197701cb903c7c

    SHA1

    53c8b981a6ecb5fdcf9310daead5ce78b46c17cb

    SHA256

    fb514932c28a8894164caf59f8e5035c4d1a793b3278999f3baca2d469539751

    SHA512

    9267ce5f778175f2686b918307f47e39b46eb958ef25921bba700db9afea990efa980539a2ebbf6c3c886ea4768035e8659a8d7bd5f7e42c3f83cdbdf61adbbd

  • \Windows\SysWOW64\smnss.exe

    Filesize

    70KB

    MD5

    c1da20dd927c85f9ae197701cb903c7c

    SHA1

    53c8b981a6ecb5fdcf9310daead5ce78b46c17cb

    SHA256

    fb514932c28a8894164caf59f8e5035c4d1a793b3278999f3baca2d469539751

    SHA512

    9267ce5f778175f2686b918307f47e39b46eb958ef25921bba700db9afea990efa980539a2ebbf6c3c886ea4768035e8659a8d7bd5f7e42c3f83cdbdf61adbbd

  • memory/2296-26-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2296-41-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2312-53-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-47-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-69-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-67-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-39-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2312-65-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-34-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-42-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-44-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2312-43-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-45-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-63-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-49-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-51-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-61-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-55-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-57-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2312-59-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2984-33-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2984-25-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2984-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2984-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2984-18-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB