Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/11/2023, 19:16

231103-xy78jsha4w 4

03/11/2023, 19:10

231103-xvd6asgh7x 4

03/11/2023, 08:07

231103-jzy5daec5v 8

03/11/2023, 08:02

231103-jw4kpaeb9z 4

03/11/2023, 07:59

231103-jve6pseb7v 8

Analysis

  • max time kernel
    42s
  • max time network
    36s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2023, 08:07

General

  • Target

    sidekick-win-installer-34426.exe

  • Size

    328KB

  • MD5

    ece86b7cc20233c01d38df7a1a93daff

  • SHA1

    de93f7d742c6c94da8ce8e700d2ee25520c6ee9f

  • SHA256

    52cb8761856ce29433d6e455ef29da70d3d7a51ff4b28f5a0a1c332655891f0f

  • SHA512

    7df133a06ad197ccc6edc3fde36de00421277c7920c8d436ca5d01680aa14dbdb1c48eedf3751268574b5093efef887f3ae618f94352dda09ca0f1d7f763390d

  • SSDEEP

    6144:0Ya6XC5Wp3+7W98/MavNNM6RYRN3BXFULW+CgD0tNYF6m0qC:0Y/p3+7W8/HNNZi7l+kDYF6mM

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Drops file in Program Files directory 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sidekick-win-installer-34426.exe
    "C:\Users\Admin\AppData\Local\Temp\sidekick-win-installer-34426.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1456

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6087b53146e9f4c85059810f3beefbe1

    SHA1

    25640272273509fb2f2008dfbc6efd54259cf639

    SHA256

    3fcb2bf1ccdfce10e48d3793baf694e755a61c2aa1276841eb92614283be862a

    SHA512

    e7ca1a5597024fe71a157fadcb4a868fec2907f28f640629f87e5d642469bf5f4ddb2bb0ef8984651bc24a3a9eddd625ea9144caf4cf2ea2db38ec87241649a9

  • C:\Users\Admin\AppData\Local\Temp\Cab3FC7.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar3FF9.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\CertCheck.dll

    Filesize

    5KB

    MD5

    2979f933cbbac19cfe35b1fa02cc95a4

    SHA1

    4f208c9c12199491d7ba3c1ee640fca615e11e92

    SHA256

    bcb6572fcb846d5b4459459a2ef9bde97628782b983eb23fadacbaec76528e6f

    SHA512

    61f07c54e0aaa59e23e244f3a7fd5e6a6c6a00730d55add8af338e33431ed166d156a66455a4f9321cafbce297e770abc1cb65f7410923cb2b5e5067d1768096

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\HttpPostFile.dll

    Filesize

    4KB

    MD5

    14f58535542482e59e1fbacafb563737

    SHA1

    9332101d425d90eafbde3ccb27487940080a9472

    SHA256

    deb32afa701ba2790a4044d6144c063cbfc26bdbb191b536e229c9e6bdacbe82

    SHA512

    3175b4f0861e2b13309012419cdbd10a09ed54e9b26f8ad362973ae3b9d88521b9c72a6b03b11e02b0eb6ccb4421417944d8277e7b5d4d6182243b9d46b91fe5

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\InetBgDL.dll

    Filesize

    7KB

    MD5

    d4f7b4f9c296308e03a55cb0896a92fc

    SHA1

    63065bed300926a5b39eabf6efdf9296ed46e0cc

    SHA256

    6b553f94ac133d8e70fac0fcaa01217fae24f85d134d3964c1beea278191cf83

    SHA512

    d4acc719ae29c53845ccf4778e1d7ed67f30358af30545fc744facdb9f4e3b05d8cb7dc5e72c93895259e9882471c056395ab2e6f238310841b767d6acbcd6c1

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\System.dll

    Filesize

    12KB

    MD5

    cff85c549d536f651d4fb8387f1976f2

    SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\WebBrowser.dll

    Filesize

    93KB

    MD5

    dfe24aa39f009e9d98b20b7c9cc070b1

    SHA1

    f48e4923c95466f689e8c5408265b52437ed2701

    SHA256

    8ec65a3d8ae8a290a6066773e49387fd368f5697392dfb58eac1b63640e30444

    SHA512

    665ce32d3776b1b41f95ed685054a796d0c1938dbc237619fa6309d1b52ae3bd44e3cf0a1f53ebf88556f7603111cca6dff1bfc917a911e0a9ce04affd0d5261

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\download.exe

    Filesize

    101.5MB

    MD5

    ad57c6b3c0b7d9eff237a400dd9804f2

    SHA1

    3b20c98077700b3f2bb9b08c79add98408b5703c

    SHA256

    c4800f9d98dac5efce4b9f5de6fafddec525e1071a7304672f77fae926246bb3

    SHA512

    714c777c3733e42365186b90b638332144459e1f948408a76458e64ba91023ce3bc1d852801d9909439681230ad54574e0128a8358644614703a6d6433012562

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\installing.html

    Filesize

    1KB

    MD5

    fae3b355070331b9c8c1f66e95c22d9f

    SHA1

    5cb394ab05d6d2ce4c9ceec66d0eff466b7f3ee2

    SHA256

    dd5d18427c52c220a8a29b25e21ce7c35669a9446978296c2e0837f5a6f08bdf

    SHA512

    32605b1b4be47aceeee193c046493041b51d9993cf29f73e4595fe10d60dc6a997a0fa3eeda74fb48a5156f971b28b715bf725bc67d44d87b5052ebf6556f6ca

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\installing.js

    Filesize

    2KB

    MD5

    dfa7861bca754036ab853b3bb02b194d

    SHA1

    46d7c5ba614b39caa4857fcba4bdedbabb2c67c0

    SHA256

    2c286b6eefd38f032a385f3ac6a1f794deab3bac0fbff71bd0ba21453f477878

    SHA512

    c58d96fb2496a84261a5e4b18cf4156a30f9ad161bbabc3652b6b5c24976f1ac432dced31927a9443260cdca0292524d1f691766b7c0731f926d37be11fe0c64

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\installing_page.css

    Filesize

    1KB

    MD5

    8d809f324dcb3b7c458fc2fad781f0c1

    SHA1

    e9b38fd62b0e3061a164db4ee79545cfb775755c

    SHA256

    90d1fccf57930fae2b128c405b911c8300fc4697ae97e1a5e54e661f89f7ce8a

    SHA512

    bc4366503e7e1c033f2b01ad76361e6b3caa0a0cc751b9beafbd0d47930a3f53536e1025dd7c22007dcf113bb72db3dc4b5ddde1f694757cd33da33c91e6e250

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\nsJSON.dll

    Filesize

    23KB

    MD5

    f4d89d9a2a3e2f164aea3e93864905c9

    SHA1

    4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a

    SHA256

    64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb

    SHA512

    dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\stub_common.css

    Filesize

    684B

    MD5

    544b51f11ad19df720669478d28f129d

    SHA1

    d238b604fd3fa37dfd552eacdc6aacc474fcddad

    SHA256

    4d9495b6f0e18331659993b79440e414a6e607fcdaeacbc7477e0683cc0fa98b

    SHA512

    bbbb0f31839316c51464cfd225166145f968ce38995dc2748df5402b7e109ff6119d65b6774fc4738638ad4c9d89776516b00ab5a700097d9d74e1824a11dc5e

  • C:\Users\Admin\AppData\Local\Temp\nsi3D50.tmp\stub_common.js

    Filesize

    817B

    MD5

    58b8ac894c64370cfa137f5848aeb88d

    SHA1

    6a1ac1f88a918a232b79fe798b2de69cf433945f

    SHA256

    0e28aa770b0afade30be85c6dc1e50344db8f8cdd3fa01989d81a9e20a4990bd

    SHA512

    ae309518e0f926021e4d9378950c1a375263247d4f79d8a8cc09464cd01653ae5e707d52a4b0c36d532e649c246f4be6b5ba8648f58fb0e3e40c495ae63180ab

  • \Users\Admin\AppData\Local\Temp\nsi3D50.tmp\CertCheck.dll

    Filesize

    5KB

    MD5

    2979f933cbbac19cfe35b1fa02cc95a4

    SHA1

    4f208c9c12199491d7ba3c1ee640fca615e11e92

    SHA256

    bcb6572fcb846d5b4459459a2ef9bde97628782b983eb23fadacbaec76528e6f

    SHA512

    61f07c54e0aaa59e23e244f3a7fd5e6a6c6a00730d55add8af338e33431ed166d156a66455a4f9321cafbce297e770abc1cb65f7410923cb2b5e5067d1768096

  • \Users\Admin\AppData\Local\Temp\nsi3D50.tmp\HttpPostFile.dll

    Filesize

    4KB

    MD5

    14f58535542482e59e1fbacafb563737

    SHA1

    9332101d425d90eafbde3ccb27487940080a9472

    SHA256

    deb32afa701ba2790a4044d6144c063cbfc26bdbb191b536e229c9e6bdacbe82

    SHA512

    3175b4f0861e2b13309012419cdbd10a09ed54e9b26f8ad362973ae3b9d88521b9c72a6b03b11e02b0eb6ccb4421417944d8277e7b5d4d6182243b9d46b91fe5

  • \Users\Admin\AppData\Local\Temp\nsi3D50.tmp\HttpPostFile.dll

    Filesize

    4KB

    MD5

    14f58535542482e59e1fbacafb563737

    SHA1

    9332101d425d90eafbde3ccb27487940080a9472

    SHA256

    deb32afa701ba2790a4044d6144c063cbfc26bdbb191b536e229c9e6bdacbe82

    SHA512

    3175b4f0861e2b13309012419cdbd10a09ed54e9b26f8ad362973ae3b9d88521b9c72a6b03b11e02b0eb6ccb4421417944d8277e7b5d4d6182243b9d46b91fe5

  • \Users\Admin\AppData\Local\Temp\nsi3D50.tmp\HttpPostFile.dll

    Filesize

    4KB

    MD5

    14f58535542482e59e1fbacafb563737

    SHA1

    9332101d425d90eafbde3ccb27487940080a9472

    SHA256

    deb32afa701ba2790a4044d6144c063cbfc26bdbb191b536e229c9e6bdacbe82

    SHA512

    3175b4f0861e2b13309012419cdbd10a09ed54e9b26f8ad362973ae3b9d88521b9c72a6b03b11e02b0eb6ccb4421417944d8277e7b5d4d6182243b9d46b91fe5

  • \Users\Admin\AppData\Local\Temp\nsi3D50.tmp\HttpPostFile.dll

    Filesize

    4KB

    MD5

    14f58535542482e59e1fbacafb563737

    SHA1

    9332101d425d90eafbde3ccb27487940080a9472

    SHA256

    deb32afa701ba2790a4044d6144c063cbfc26bdbb191b536e229c9e6bdacbe82

    SHA512

    3175b4f0861e2b13309012419cdbd10a09ed54e9b26f8ad362973ae3b9d88521b9c72a6b03b11e02b0eb6ccb4421417944d8277e7b5d4d6182243b9d46b91fe5

  • \Users\Admin\AppData\Local\Temp\nsi3D50.tmp\InetBgDL.dll

    Filesize

    7KB

    MD5

    d4f7b4f9c296308e03a55cb0896a92fc

    SHA1

    63065bed300926a5b39eabf6efdf9296ed46e0cc

    SHA256

    6b553f94ac133d8e70fac0fcaa01217fae24f85d134d3964c1beea278191cf83

    SHA512

    d4acc719ae29c53845ccf4778e1d7ed67f30358af30545fc744facdb9f4e3b05d8cb7dc5e72c93895259e9882471c056395ab2e6f238310841b767d6acbcd6c1

  • \Users\Admin\AppData\Local\Temp\nsi3D50.tmp\System.dll

    Filesize

    12KB

    MD5

    cff85c549d536f651d4fb8387f1976f2

    SHA1

    d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    SHA256

    8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    SHA512

    531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

  • \Users\Admin\AppData\Local\Temp\nsi3D50.tmp\WebBrowser.dll

    Filesize

    93KB

    MD5

    dfe24aa39f009e9d98b20b7c9cc070b1

    SHA1

    f48e4923c95466f689e8c5408265b52437ed2701

    SHA256

    8ec65a3d8ae8a290a6066773e49387fd368f5697392dfb58eac1b63640e30444

    SHA512

    665ce32d3776b1b41f95ed685054a796d0c1938dbc237619fa6309d1b52ae3bd44e3cf0a1f53ebf88556f7603111cca6dff1bfc917a911e0a9ce04affd0d5261

  • \Users\Admin\AppData\Local\Temp\nsi3D50.tmp\nsJSON.dll

    Filesize

    23KB

    MD5

    f4d89d9a2a3e2f164aea3e93864905c9

    SHA1

    4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a

    SHA256

    64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb

    SHA512

    dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2