Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    02/11/2023, 21:41

General

  • Target

    NEAS.6558f2354d65e18e6dd92848965ca440_JC.exe

  • Size

    484KB

  • MD5

    6558f2354d65e18e6dd92848965ca440

  • SHA1

    fb453c960ae29e23f0afff1f584639661fdbe4d5

  • SHA256

    51591f35883b685ab8d4629614d39ef3d06a64b3ce44bbfab821ada9be29f8df

  • SHA512

    fec62bc7444e18800bad5cff2e00aa60f5916a1c2b69112240cfd8ac6e8de8a5331b754ba1ae8d925dd0dd281b80bce8ce773c5c7bd30898e37942140139f4e2

  • SSDEEP

    12288:yLPkCDt1EG2XVekhdeT1ZfTBmYjHYJH7PEzYa:yLPkQ1bqA91Td4JbPEx

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1264
    • C:\Users\Admin\AppData\Local\Temp\NEAS.6558f2354d65e18e6dd92848965ca440_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6558f2354d65e18e6dd92848965ca440_JC.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Users\Admin\AppData\Roaming\calcerpt\fltMKEYs.exe
        "C:\Users\Admin\AppData\Roaming\calcerpt"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1088
        • C:\Users\Admin\AppData\Local\Temp\~9EEE.tmp
          1264 496136 1088 1
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2652
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 252
        3⤵
        • Program crash
        PID:2588
  • C:\Windows\SysWOW64\dcomcont.exe
    C:\Windows\SysWOW64\dcomcont.exe -s
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    PID:2964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~9EEE.tmp

    Filesize

    8KB

    MD5

    aac3165ece2959f39ff98334618d10d9

    SHA1

    020a191bfdc70c1fbd3bf74cd7479258bd197f51

    SHA256

    96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974

    SHA512

    9eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf

  • C:\Users\Admin\AppData\Roaming\calcerpt\fltMKEYs.exe

    Filesize

    484KB

    MD5

    1c327e3ef924478beae7f357c4816cd0

    SHA1

    4b423d0d6d108f516a6f4ea62ceb294af086a02d

    SHA256

    c69773c421f3fce6c2a90cd4c2559a6768de2294879b1fbf4c086667fa64bef1

    SHA512

    ac8ad19f332145a3d4f9c3dee56ece5ac422b7023d5f804c14b5610b8acca20d0954e2207ee4ef0d8e58494b99b4b32559d7b6605e5a46d186e848a149b03c06

  • C:\Users\Admin\AppData\Roaming\calcerpt\fltMKEYs.exe

    Filesize

    484KB

    MD5

    1c327e3ef924478beae7f357c4816cd0

    SHA1

    4b423d0d6d108f516a6f4ea62ceb294af086a02d

    SHA256

    c69773c421f3fce6c2a90cd4c2559a6768de2294879b1fbf4c086667fa64bef1

    SHA512

    ac8ad19f332145a3d4f9c3dee56ece5ac422b7023d5f804c14b5610b8acca20d0954e2207ee4ef0d8e58494b99b4b32559d7b6605e5a46d186e848a149b03c06

  • C:\Users\Admin\AppData\Roaming\calcerpt\fltMKEYs.exe

    Filesize

    484KB

    MD5

    1c327e3ef924478beae7f357c4816cd0

    SHA1

    4b423d0d6d108f516a6f4ea62ceb294af086a02d

    SHA256

    c69773c421f3fce6c2a90cd4c2559a6768de2294879b1fbf4c086667fa64bef1

    SHA512

    ac8ad19f332145a3d4f9c3dee56ece5ac422b7023d5f804c14b5610b8acca20d0954e2207ee4ef0d8e58494b99b4b32559d7b6605e5a46d186e848a149b03c06

  • C:\Windows\SysWOW64\dcomcont.exe

    Filesize

    484KB

    MD5

    1c327e3ef924478beae7f357c4816cd0

    SHA1

    4b423d0d6d108f516a6f4ea62ceb294af086a02d

    SHA256

    c69773c421f3fce6c2a90cd4c2559a6768de2294879b1fbf4c086667fa64bef1

    SHA512

    ac8ad19f332145a3d4f9c3dee56ece5ac422b7023d5f804c14b5610b8acca20d0954e2207ee4ef0d8e58494b99b4b32559d7b6605e5a46d186e848a149b03c06

  • C:\Windows\SysWOW64\dcomcont.exe

    Filesize

    484KB

    MD5

    1c327e3ef924478beae7f357c4816cd0

    SHA1

    4b423d0d6d108f516a6f4ea62ceb294af086a02d

    SHA256

    c69773c421f3fce6c2a90cd4c2559a6768de2294879b1fbf4c086667fa64bef1

    SHA512

    ac8ad19f332145a3d4f9c3dee56ece5ac422b7023d5f804c14b5610b8acca20d0954e2207ee4ef0d8e58494b99b4b32559d7b6605e5a46d186e848a149b03c06

  • \Users\Admin\AppData\Local\Temp\~9EEE.tmp

    Filesize

    8KB

    MD5

    aac3165ece2959f39ff98334618d10d9

    SHA1

    020a191bfdc70c1fbd3bf74cd7479258bd197f51

    SHA256

    96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974

    SHA512

    9eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf

  • \Users\Admin\AppData\Roaming\calcerpt\fltMKEYs.exe

    Filesize

    484KB

    MD5

    1c327e3ef924478beae7f357c4816cd0

    SHA1

    4b423d0d6d108f516a6f4ea62ceb294af086a02d

    SHA256

    c69773c421f3fce6c2a90cd4c2559a6768de2294879b1fbf4c086667fa64bef1

    SHA512

    ac8ad19f332145a3d4f9c3dee56ece5ac422b7023d5f804c14b5610b8acca20d0954e2207ee4ef0d8e58494b99b4b32559d7b6605e5a46d186e848a149b03c06

  • \Users\Admin\AppData\Roaming\calcerpt\fltMKEYs.exe

    Filesize

    484KB

    MD5

    1c327e3ef924478beae7f357c4816cd0

    SHA1

    4b423d0d6d108f516a6f4ea62ceb294af086a02d

    SHA256

    c69773c421f3fce6c2a90cd4c2559a6768de2294879b1fbf4c086667fa64bef1

    SHA512

    ac8ad19f332145a3d4f9c3dee56ece5ac422b7023d5f804c14b5610b8acca20d0954e2207ee4ef0d8e58494b99b4b32559d7b6605e5a46d186e848a149b03c06

  • memory/1088-12-0x00000000004B0000-0x0000000000533000-memory.dmp

    Filesize

    524KB

  • memory/1088-13-0x0000000000090000-0x0000000000096000-memory.dmp

    Filesize

    24KB

  • memory/1264-22-0x0000000002750000-0x0000000002756000-memory.dmp

    Filesize

    24KB

  • memory/1264-19-0x00000000042A0000-0x0000000004329000-memory.dmp

    Filesize

    548KB

  • memory/1264-18-0x00000000042A0000-0x0000000004329000-memory.dmp

    Filesize

    548KB

  • memory/1264-25-0x0000000002760000-0x000000000276D000-memory.dmp

    Filesize

    52KB

  • memory/1264-17-0x00000000042A0000-0x0000000004329000-memory.dmp

    Filesize

    548KB

  • memory/2940-0-0x0000000000180000-0x0000000000203000-memory.dmp

    Filesize

    524KB

  • memory/2940-33-0x0000000000180000-0x0000000000203000-memory.dmp

    Filesize

    524KB

  • memory/2964-30-0x0000000000430000-0x00000000004B3000-memory.dmp

    Filesize

    524KB

  • memory/2964-32-0x0000000000180000-0x0000000000186000-memory.dmp

    Filesize

    24KB

  • memory/2964-31-0x0000000000190000-0x0000000000196000-memory.dmp

    Filesize

    24KB

  • memory/2964-34-0x0000000000180000-0x0000000000186000-memory.dmp

    Filesize

    24KB

  • memory/2964-35-0x0000000000180000-0x0000000000186000-memory.dmp

    Filesize

    24KB