Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    17/11/2023, 12:03

General

  • Target

    7c8dd8652f58dc1be9d0f313dd7ed2c97fb698860d08ea0753e932fa2bb6e573.exe

  • Size

    223KB

  • MD5

    481ae3f07c96b7beac6e90a319beeb15

  • SHA1

    62c08dbdc7c4ccde919dcdcc4e689957bb7ae713

  • SHA256

    7c8dd8652f58dc1be9d0f313dd7ed2c97fb698860d08ea0753e932fa2bb6e573

  • SHA512

    3dce6ae29525f1308c94e35bf4d87983d49f2e30e0799c3474f291632212874212f6339766c72a5efed5f90ca5f84c27f5207dade4bf86468bce0e5d0f3ba719

  • SSDEEP

    6144:8wPSUONLNsuWA7koN+boRhZ2VUUaSaE0A6Xvd2:8OuW5o/oVU1r5w

Score
10/10
upx

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:424
      • C:\Program Files\cttunesvr.exe
        "C:\Program Files\cttunesvr.exe"
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2596
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1380
      • C:\Users\Admin\AppData\Local\Temp\7c8dd8652f58dc1be9d0f313dd7ed2c97fb698860d08ea0753e932fa2bb6e573.exe
        "C:\Users\Admin\AppData\Local\Temp\7c8dd8652f58dc1be9d0f313dd7ed2c97fb698860d08ea0753e932fa2bb6e573.exe"
        2⤵
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3036
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\7c8dd8652f58dc1be9d0f313dd7ed2c97fb698860d08ea0753e932fa2bb6e573.exe"
          3⤵
          • Deletes itself
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 1
            4⤵
            • Delays execution with timeout.exe
            PID:1944

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\cttunesvr.exe

      Filesize

      39KB

      MD5

      466d30f69f4ace6830162ccde90791df

      SHA1

      3eef9cfa5c979f3b7068e8a5dcc48e05702368f8

      SHA256

      195821c69cbef8f4ba629c4876967ca3e58ee852b5f0c5e4935d684649936926

      SHA512

      c8116707e1f96452091db056d877bd38957ae1bfd107975ecad8043ef42a61ccb1ca55c4b50147cb149e1812d52849182571e175a993ba7bcd53115a21c5ce56

    • C:\Users\Admin\AppData\Local\Temp\Cab62AB.tmp

      Filesize

      61KB

      MD5

      f3441b8572aae8801c04f3060b550443

      SHA1

      4ef0a35436125d6821831ef36c28ffaf196cda15

      SHA256

      6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

      SHA512

      5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    • C:\Users\Admin\AppData\Local\Temp\Tar8E60.tmp

      Filesize

      163KB

      MD5

      9441737383d21192400eca82fda910ec

      SHA1

      725e0d606a4fc9ba44aa8ffde65bed15e65367e4

      SHA256

      bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

      SHA512

      7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

    • \Program Files\cttunesvr.exe

      Filesize

      39KB

      MD5

      466d30f69f4ace6830162ccde90791df

      SHA1

      3eef9cfa5c979f3b7068e8a5dcc48e05702368f8

      SHA256

      195821c69cbef8f4ba629c4876967ca3e58ee852b5f0c5e4935d684649936926

      SHA512

      c8116707e1f96452091db056d877bd38957ae1bfd107975ecad8043ef42a61ccb1ca55c4b50147cb149e1812d52849182571e175a993ba7bcd53115a21c5ce56

    • memory/424-45-0x0000000000880000-0x00000000008A8000-memory.dmp

      Filesize

      160KB

    • memory/424-107-0x0000000000880000-0x00000000008A8000-memory.dmp

      Filesize

      160KB

    • memory/424-43-0x0000000000760000-0x0000000000763000-memory.dmp

      Filesize

      12KB

    • memory/1380-17-0x0000000002670000-0x0000000002673000-memory.dmp

      Filesize

      12KB

    • memory/1380-20-0x0000000002670000-0x0000000002673000-memory.dmp

      Filesize

      12KB

    • memory/1380-18-0x0000000002670000-0x0000000002673000-memory.dmp

      Filesize

      12KB

    • memory/1380-21-0x0000000006C90000-0x0000000006D89000-memory.dmp

      Filesize

      996KB

    • memory/1380-98-0x0000000006C90000-0x0000000006D89000-memory.dmp

      Filesize

      996KB

    • memory/2596-26-0x00000000001B0000-0x00000000001B1000-memory.dmp

      Filesize

      4KB

    • memory/2596-102-0x0000000001E60000-0x0000000001E61000-memory.dmp

      Filesize

      4KB

    • memory/2596-41-0x000007FEBF340000-0x000007FEBF350000-memory.dmp

      Filesize

      64KB

    • memory/2596-38-0x00000000004D0000-0x000000000059B000-memory.dmp

      Filesize

      812KB

    • memory/2596-36-0x00000000001E0000-0x00000000001E3000-memory.dmp

      Filesize

      12KB

    • memory/2596-109-0x0000000004620000-0x00000000047E5000-memory.dmp

      Filesize

      1.8MB

    • memory/2596-32-0x00000000001E0000-0x00000000001E3000-memory.dmp

      Filesize

      12KB

    • memory/2596-108-0x0000000001E60000-0x0000000001E61000-memory.dmp

      Filesize

      4KB

    • memory/2596-95-0x0000000037760000-0x0000000037770000-memory.dmp

      Filesize

      64KB

    • memory/2596-97-0x0000000000880000-0x00000000008A8000-memory.dmp

      Filesize

      160KB

    • memory/2596-25-0x00000000000E0000-0x00000000001A3000-memory.dmp

      Filesize

      780KB

    • memory/2596-40-0x00000000004D0000-0x000000000059B000-memory.dmp

      Filesize

      812KB

    • memory/2596-101-0x0000000001E60000-0x0000000001E61000-memory.dmp

      Filesize

      4KB

    • memory/2596-100-0x0000000001E60000-0x0000000001E61000-memory.dmp

      Filesize

      4KB

    • memory/2596-99-0x0000000001E60000-0x0000000001E61000-memory.dmp

      Filesize

      4KB

    • memory/2596-103-0x00000000004D0000-0x000000000059B000-memory.dmp

      Filesize

      812KB

    • memory/2596-104-0x00000000004D0000-0x000000000059B000-memory.dmp

      Filesize

      812KB

    • memory/2596-105-0x0000000004620000-0x00000000047E5000-memory.dmp

      Filesize

      1.8MB

    • memory/2596-106-0x0000000004620000-0x00000000047E5000-memory.dmp

      Filesize

      1.8MB

    • memory/3036-0-0x0000000000DF0000-0x0000000000E5E000-memory.dmp

      Filesize

      440KB

    • memory/3036-85-0x0000000000DF0000-0x0000000000E5E000-memory.dmp

      Filesize

      440KB

    • memory/3036-47-0x0000000000DF0000-0x0000000000E5E000-memory.dmp

      Filesize

      440KB