Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    14/11/2023, 18:49

General

  • Target

    0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe

  • Size

    118KB

  • MD5

    bb8c3055d4d73512c2faab4449601a90

  • SHA1

    12d9b881e6e83a1a16874bb5e6b2068e9fd50da4

  • SHA256

    0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c

  • SHA512

    f0e38c42e8780eaa62eed5c2fd5499adf1f609ecaa431a0fb3564a00284f1d57fc0db46ea0db131b60db2099b901b5f2afb7afe2064bd15b6d54b130d90254c1

  • SSDEEP

    3072:XOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:XIs9OKofHfHTXQLzgvnzHPowYbvrjD/m

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe
    "C:\Users\Admin\AppData\Local\Temp\0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    5bdda0c8be334b1c90776e9327461ab4

    SHA1

    538fbd8b72516f77693d8738223e980c64238426

    SHA256

    4a70cca49f38699bb12023a58f056dbc6587852198cc2a0d537d675861c9580d

    SHA512

    441d41945af635faa80b49a282ef3e54afc7ede427168a0dd22835359de2645baa7d7b0f0ab50fbab03fec6e4dc144a7741acec23c359b611cf93292feeb7a4b

  • C:\Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    5bdda0c8be334b1c90776e9327461ab4

    SHA1

    538fbd8b72516f77693d8738223e980c64238426

    SHA256

    4a70cca49f38699bb12023a58f056dbc6587852198cc2a0d537d675861c9580d

    SHA512

    441d41945af635faa80b49a282ef3e54afc7ede427168a0dd22835359de2645baa7d7b0f0ab50fbab03fec6e4dc144a7741acec23c359b611cf93292feeb7a4b

  • C:\Windows\SysWOW64\grcopy.dll

    Filesize

    118KB

    MD5

    61bc9830f8dcaec962502d4ce7a88e02

    SHA1

    cc92ea7dbe24cc5ff46c66871132c5308fee8a40

    SHA256

    318205611ef6ea94dd33c2db865458fda656e053fb5d606e4c9879c6eeb50280

    SHA512

    a709bfc711059cd920491b2724a6369e928b8f0600aa63ac86bdc0b4fd18538edc3c496a08eb374833d97515ff8d030d8c22eb91177444d71c3d3690eec5a96c

  • C:\Windows\SysWOW64\satornas.dll

    Filesize

    183B

    MD5

    7fb8b7e59773bb46c4c94a78a9f55995

    SHA1

    39ff75183232733441a30a953ab1853236c8c20f

    SHA256

    d5709eb55feb7e583c83de46e2f9b432fd66b8496de2f4cfe98d5cd04db1878e

    SHA512

    f98f26952e360f0f2af63d76b6d3ac23c70732a1a9bfa9958ba9d735d7d91b73079a45c4f5975fa9e1f81ba9e881106e830cf0595f7feb74e775e4f1d844b84f

  • C:\Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    64b04c8c5b40d36a5fed73a0fefefb63

    SHA1

    03e93192b26f085917e8cca7b0bca0d1e9dd54da

    SHA256

    7bbd5af1ea238ec867fb1e62aa07fbc53df607e1dd1cd9bea81c49fca0a20619

    SHA512

    cbadd1925ed6f85258fbefd560255543ce6b540aee4564a097041956e930cefd1e17c2941297fb1c519f96c6f28302f7bad676010e5b6cf35e47b9d18fc18ad2

  • C:\Windows\SysWOW64\smnss.exe

    Filesize

    118KB

    MD5

    61bc9830f8dcaec962502d4ce7a88e02

    SHA1

    cc92ea7dbe24cc5ff46c66871132c5308fee8a40

    SHA256

    318205611ef6ea94dd33c2db865458fda656e053fb5d606e4c9879c6eeb50280

    SHA512

    a709bfc711059cd920491b2724a6369e928b8f0600aa63ac86bdc0b4fd18538edc3c496a08eb374833d97515ff8d030d8c22eb91177444d71c3d3690eec5a96c

  • C:\Windows\SysWOW64\smnss.exe

    Filesize

    118KB

    MD5

    61bc9830f8dcaec962502d4ce7a88e02

    SHA1

    cc92ea7dbe24cc5ff46c66871132c5308fee8a40

    SHA256

    318205611ef6ea94dd33c2db865458fda656e053fb5d606e4c9879c6eeb50280

    SHA512

    a709bfc711059cd920491b2724a6369e928b8f0600aa63ac86bdc0b4fd18538edc3c496a08eb374833d97515ff8d030d8c22eb91177444d71c3d3690eec5a96c

  • \Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    5bdda0c8be334b1c90776e9327461ab4

    SHA1

    538fbd8b72516f77693d8738223e980c64238426

    SHA256

    4a70cca49f38699bb12023a58f056dbc6587852198cc2a0d537d675861c9580d

    SHA512

    441d41945af635faa80b49a282ef3e54afc7ede427168a0dd22835359de2645baa7d7b0f0ab50fbab03fec6e4dc144a7741acec23c359b611cf93292feeb7a4b

  • \Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    5bdda0c8be334b1c90776e9327461ab4

    SHA1

    538fbd8b72516f77693d8738223e980c64238426

    SHA256

    4a70cca49f38699bb12023a58f056dbc6587852198cc2a0d537d675861c9580d

    SHA512

    441d41945af635faa80b49a282ef3e54afc7ede427168a0dd22835359de2645baa7d7b0f0ab50fbab03fec6e4dc144a7741acec23c359b611cf93292feeb7a4b

  • \Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    64b04c8c5b40d36a5fed73a0fefefb63

    SHA1

    03e93192b26f085917e8cca7b0bca0d1e9dd54da

    SHA256

    7bbd5af1ea238ec867fb1e62aa07fbc53df607e1dd1cd9bea81c49fca0a20619

    SHA512

    cbadd1925ed6f85258fbefd560255543ce6b540aee4564a097041956e930cefd1e17c2941297fb1c519f96c6f28302f7bad676010e5b6cf35e47b9d18fc18ad2

  • \Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    64b04c8c5b40d36a5fed73a0fefefb63

    SHA1

    03e93192b26f085917e8cca7b0bca0d1e9dd54da

    SHA256

    7bbd5af1ea238ec867fb1e62aa07fbc53df607e1dd1cd9bea81c49fca0a20619

    SHA512

    cbadd1925ed6f85258fbefd560255543ce6b540aee4564a097041956e930cefd1e17c2941297fb1c519f96c6f28302f7bad676010e5b6cf35e47b9d18fc18ad2

  • \Windows\SysWOW64\smnss.exe

    Filesize

    118KB

    MD5

    61bc9830f8dcaec962502d4ce7a88e02

    SHA1

    cc92ea7dbe24cc5ff46c66871132c5308fee8a40

    SHA256

    318205611ef6ea94dd33c2db865458fda656e053fb5d606e4c9879c6eeb50280

    SHA512

    a709bfc711059cd920491b2724a6369e928b8f0600aa63ac86bdc0b4fd18538edc3c496a08eb374833d97515ff8d030d8c22eb91177444d71c3d3690eec5a96c

  • \Windows\SysWOW64\smnss.exe

    Filesize

    118KB

    MD5

    61bc9830f8dcaec962502d4ce7a88e02

    SHA1

    cc92ea7dbe24cc5ff46c66871132c5308fee8a40

    SHA256

    318205611ef6ea94dd33c2db865458fda656e053fb5d606e4c9879c6eeb50280

    SHA512

    a709bfc711059cd920491b2724a6369e928b8f0600aa63ac86bdc0b4fd18538edc3c496a08eb374833d97515ff8d030d8c22eb91177444d71c3d3690eec5a96c

  • memory/2132-18-0x0000000000350000-0x0000000000359000-memory.dmp

    Filesize

    36KB

  • memory/2132-28-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2132-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2132-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2132-25-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2716-38-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2716-40-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2716-42-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2716-45-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3040-26-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3040-33-0x0000000000320000-0x000000000033F000-memory.dmp

    Filesize

    124KB

  • memory/3040-44-0x0000000000320000-0x000000000033F000-memory.dmp

    Filesize

    124KB