Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 23:23
Static task
static1
Behavioral task
behavioral1
Sample
1943366f1f3f80a134387769af828546.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1943366f1f3f80a134387769af828546.exe
Resource
win10v2004-20231215-en
General
-
Target
1943366f1f3f80a134387769af828546.exe
-
Size
11.4MB
-
MD5
1943366f1f3f80a134387769af828546
-
SHA1
583bdd87062654ccbb1b7ac3a788a5a62e6bb495
-
SHA256
da8aba5a1bbb963c0c543769395332e030e03ca497ea7ee9a3c969c6ae6c1145
-
SHA512
6d32754d45cc0a2711b3884c47821a9c7a4939f0e28de6793186429a0d928a1410dfc61c55a75a025fa884a47b45193a3aa92c04bcf98883afb7e0df3dbe7746
-
SSDEEP
196608:UTwx42RPPBdebEm1iWWHc1SUX6apg3ZhncrJPm59vzgO8L1vsqFRUo7t/IbsCTMp:UaRPiGWW8sUtu/Am5q91vsqFRn5AACT8
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2688 5274.tmp 2868 5419.tmp 2864 5439.tmp 2604 5439.tmp -
Loads dropped DLL 11 IoCs
pid Process 1628 1943366f1f3f80a134387769af828546.exe 2688 5274.tmp 2688 5274.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 5419.tmp -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy 5419.tmp File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 5419.tmp -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\fonts\pns.ttf 5419.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main 5419.tmp -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\chst 5439.tmp Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\chst 5439.tmp Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\chst 5439.tmp -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 5419.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 5419.tmp -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2868 5419.tmp Token: SeRestorePrivilege 2868 5419.tmp Token: SeDebugPrivilege 2868 5419.tmp -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp 2868 5419.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2868 5419.tmp 2868 5419.tmp -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2688 1628 1943366f1f3f80a134387769af828546.exe 28 PID 1628 wrote to memory of 2688 1628 1943366f1f3f80a134387769af828546.exe 28 PID 1628 wrote to memory of 2688 1628 1943366f1f3f80a134387769af828546.exe 28 PID 1628 wrote to memory of 2688 1628 1943366f1f3f80a134387769af828546.exe 28 PID 2688 wrote to memory of 2868 2688 5274.tmp 31 PID 2688 wrote to memory of 2868 2688 5274.tmp 31 PID 2688 wrote to memory of 2868 2688 5274.tmp 31 PID 2688 wrote to memory of 2868 2688 5274.tmp 31 PID 2688 wrote to memory of 2864 2688 5274.tmp 30 PID 2688 wrote to memory of 2864 2688 5274.tmp 30 PID 2688 wrote to memory of 2864 2688 5274.tmp 30 PID 2688 wrote to memory of 2864 2688 5274.tmp 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1943366f1f3f80a134387769af828546.exe"C:\Users\Admin\AppData\Local\Temp\1943366f1f3f80a134387769af828546.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\5439.tmp"C:\Users\Admin\AppData\Local\Temp\5439.tmp" "install"3⤵
- Executes dropped EXE
PID:2864
-
-
C:\Users\Admin\AppData\Local\Temp\5419.tmp"C:\Users\Admin\AppData\Local\Temp\5419.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2868
-
-
-
C:\Users\Admin\AppData\Local\Temp\5439.tmp"C:\Users\Admin\AppData\Local\Temp\5439.tmp" run1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f02bec564006ffa60cb1ff2da7bcd20a
SHA106a446b690806fe5e28c9194a81da7b5d69ef56b
SHA2565027664ff083d46e3cc0b4a5263f8b05cfa61525c0b4f7710fed4f0c0d3a4080
SHA512c82ef332e98f415d326dc1136fd63f3e3239c582df0825a310b47578a33358269497a8a3fcea55325fa6e698034ec583c984ea4dfd24ea3cb4851158fafbb859
-
Filesize
70KB
MD5ee643c671b52abc43ec9eaa0f1b4509f
SHA1bc8fde57de9ba601204095240adb2c71c6d8325e
SHA256d553e557888d6015cb148e08271fb78f5a493d00188235344e740d8f8d340be4
SHA512b070833dc05c3a9aff93ffec31a833b484cf8a8e750c0804c90a9d58355f714b2fb13530f6b6a948851534ce07e41c380e4b18ebbabcb847643243e1980e8cf1
-
Filesize
90KB
MD54e6ceb37f4109211ebb2999f83a97028
SHA11d4d2be96b04d10f9f8b152fb59fa95c1adde06d
SHA256d61c9b53467846748ec147328c0afab8e8072144bbc5e074bd28cd584d69c8bd
SHA512e15e424f8e28e3a32a70d4d099bd1df2a7a073fb806961ed71843d33936531bff01e9c1b93e9eb8e193be2d2e39941ce49004459e4afb364fbeb2a247dfc81fb
-
Filesize
34KB
MD547c868b018a2456976457d1d1c465bcf
SHA14eb65eff8ab17be3b55cda12ba64dfee5046acf0
SHA256a1d85f54ebc0f43f63fe1287524d614d9cb8944f3211f679e459324030b78973
SHA512a6dbbdbfa0cd15493a901a5bb620235ad3c8f462f0a1ef79f5539921980d0b2261fbc7dda1e934b3e22b919d9beb1a83642068c7e8a9faaf7b49593db933a2a0
-
Filesize
170KB
MD5cc7f0363afedc16668e085749c65c697
SHA13bfaf1e1bb014e8ea33b222ecb41edbfdfa91068
SHA2562a8fbba82835053d5901f020b9a5a475c2c5a8b15b8cee2b3d3f294470c85c73
SHA512b699ad01c9e8342aaab7de3bf1f72331d97e5cebb6c36404a63463712a413be2ada6d4f0b14f0c64c147b51cae426d5c982a6a2a87ff3ccea6ed14192d2702a1
-
Filesize
231KB
MD5908d81d408f3c10ab30ab1c0b8e78cee
SHA1efd3fa36da9ff4df4c0845ebe908061aa44a5544
SHA2564854c0fe620d3815f5e0972e77aff0b9ac31fad6978e188c0099d5fb84b73b0d
SHA512d99e5d6974c381dc9cd0e8b31fefe497f71cfa2a627ba0198f7cc60086c14b140c1908597f69adbd46075250fda79762f4d71cdcc1df85ec396cdd76e664b53c
-
Filesize
99KB
MD5fb82f9e9c27a84eecf672bbcd9d842bc
SHA1ffbcc634646e5b9a69569ae8249dc1f5ca0685cb
SHA2568987bf5053fc6d1e8ad1c255888fd622af7fcadce505c324ebb6428590e15ac0
SHA512cfce48f1b34c6df96333d94c451e3eb81305f8893a04df8b6b57179e4c37008ebc417d974c7ade00f921e8148e71590c2d3176b403e42e942a82aabaa7057d9d
-
Filesize
232KB
MD5220e4b0bcdcdee3f219e5cf676a390af
SHA1d959c5d8a69cbd81ef03d203dde99d4cd2cd4197
SHA256b83916a2b6f32eb1fe111955427598834aa65166427671d35a7969524e94c358
SHA51290f2867f76ced8d2fdb16fe666d7e37ace970380fdd74de39620ca7554c57feb991b8f90162a7fe1459221cd6ec8b656a3e97e77b880a69a98d1f4adb3eaf185
-
Filesize
86KB
MD538952f58f10ef1773d603758484dc858
SHA194b2164f7d7c0aea243f5a6d7ce14926563f0f7a
SHA2563d9ac29eddff2780e7f3b7fcba8c8b611644caed301b59f5c78994fd765dc911
SHA512cded3cb79cddb72287410b107019e4caac19188f9d1cfc4f6b59d4c43fe445457f2dd036c57f83dbb3b292c5f487a88eee201464fd8d5af2257ef7271058c9d7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
43KB
MD591c71861c4c0fff27b979cf1305869a6
SHA11ca9e5edfbcbd64d5f05b820f8c03ad79becdff6
SHA256305d4e4d69512158810c3274ef77ad2af48c34002ec20b352d1a1d6574115249
SHA512d97d8dfa6a8f8cb21b7de6a393295b5f9950b77a2b0a04005d8b22472d06e3a7bc18dc4d08a4826aa274769555b4b1e9947daad6c7b516b3ee009084a2cb4f68
-
Filesize
1KB
MD5c658908ecf605515416768b1aff80289
SHA1bb71e6d8bad58a388b549bedcca0ffe092e0a0f8
SHA2569e87f3b59ba14422a264e6b37f9cf95c29b68a4dcf9b5684c5aa02d4b3fdb170
SHA512116cb243db6c1d087ce6b822001a3679c0a14ee11886728b200ee9aa6b84b1bf98aaab364db2046e58dfc233d01862c94d81db805efb2df95ebe027c82793743
-
Filesize
127KB
MD5df8c626474a73ab7a8b511655597c7c4
SHA15de28f387ea88553d195d1978286d43c33231969
SHA256723091ba5a1b8e65164075516d69c00c71225c6dde61ffc32dd4047803ab42b5
SHA512c8f7d1577cb70610c40b96c835faca6b916c4924b5061351c8a67287567556b2014efb7c73cdcc4fb6533829541cd0264b8a9e428d3c572e29c06b0d96633d59
-
Filesize
91KB
MD5658e5e6cede79b9794690682a0eafbf0
SHA1bb62af90c44579390e35f43dc090a05d6d550d91
SHA25637fd02f902835b5ff3121be9a822af7e99c7fdfe2ada0154c2e5e04e20e36855
SHA512a9bd4de1b1bb6c8459b7f727e28502cdf79fb89d896e88b14d7f39ccabd5c9dbf471083c91179c6e13658fe0cd34deaadac7356fa89257aee63de088f64b4799
-
Filesize
69KB
MD5a55e09333dafa187468fa9fa0860b3c7
SHA1dc2c1143064985c3a817ce2ae34bb5d52f7d81a5
SHA256ec8e835289ae1ed1f8fc8995b8a3c20650ff3be4e74f7c3c3a50c525f36d043c
SHA512eca735ddba16e833a6b78246fadc091d42479ea38709d3771850968f3763977a5f54cc7af924a544fa36d6844e23ff616e1a843ac4c9ea3e7602a92ccc008bb2
-
Filesize
62KB
MD566a3734ac39197c5e9d3a148653b99c3
SHA12aa55bff7cc1db5f1655b9a3ddbd44e6709f315c
SHA256c0e88f23b668a20d4e691bb7ebad54ae06c193329f553de8e65c587210bd9eff
SHA51268d2ecc25005894d302c6d32d169b2579e56999bd8f714b26ae0af75779f50f2c5f3c43147673839d86fa6e478f068e203b7dea635239601065303355272557b
-
Filesize
124KB
MD5f9aabbfbcce29be73dd63c4e31b927ae
SHA1a5db98a10741ceeac35aa6036271631385ca3479
SHA2561b25be3b07ec2adb08acc15a659a6c5765bb28d92c458e0ab3e9650f40b66440
SHA512a28319755aeae08b23c370a96cfe668ce40fb069750df00398ae431810d58aa76d196a076fa12e09df1123e569136a9d62b42a9d19a31a56cb08e4cc2a1f46d6
-
Filesize
64KB
MD5b22998a86e5ff723244b4379c5e6543c
SHA140d118855cc5196b24387f1ed25e0c0cecad4a4f
SHA2569405c33f4f4b2b0736041fac4b5c656317c7330c97f15c02def475bdbf9b2e16
SHA5120f8d770745e7feb500284e4925a35dbc7b487b047883f570fb103401d618d9440a27af09fe9e3dd3b42bc41e746beb009b1e91c83ade1d1ffaa6958d546160d2
-
Filesize
92KB
MD52027b7309f4c7baf9414004a5f1f5dc3
SHA1b4f062dbfa4df84704e42290edb5202ca4f2b34c
SHA256623ecf69c790ad4f2aac2b93fedebfb01407ed8e40ab8b1b8cd2e4f384df6aae
SHA512e6572c1c5bca8e42c2304dca1a76816229a140aa108c7fe144529f119641b43c76da53db8976364c6a2f6b4ca6ce8200ca6fc37c9ad0cd882482d46805975baa
-
Filesize
122KB
MD5b8e29dde64198b21a97a6c12946bf5f0
SHA14b89799f046199b975046d1fc13931258b619308
SHA2569cd12137711c0e18b61814681f299bb4d770b7282a39dc17e159101eeee28883
SHA51272fd2e77d01d36eb2ea522c6a84c2dfe556643889138e9fffa8c010474b192f02f79f2273a400ee3063665b5a2da1740fa25e9f47799e27d5549305d53bf21f0
-
Filesize
45KB
MD53fd7234a1413e3b9126ca78700d29c9c
SHA1a24c5b32bcdc97e9475e44a9e16d10dfb839aba2
SHA256ffad57c3de3859b1861640162d7124633ae9bd33af3a0fe27a7113aba0714887
SHA512e83276c766b4cdafa4f3e064fc841d7c165d86feac5b22391a2e59b69d3a6375c08ee47b44f8686a77db871314fcdc25f3c0e59b249b8b007861afceeca412ab
-
Filesize
299KB
MD5ff52ef2750f84f91ef005ffbeb5458ec
SHA1f0684c3e172adb7387c4c8e33e63834675ea895a
SHA25654831ca4a09e976a6fb3767cf780454ababb07c3a06c33ed8957a818db65758b
SHA51206376dafacff2ceda217c3a5d5eaf3afedd206cbb0902511997fc657347e7f6f4718fd2bb31aec3285e2f56dc64ca1b83a8dab6877dd515d80a37e80cffd85ad
-
Filesize
202KB
MD50f91ea48caff93358eecff65608593e5
SHA1f86fecb21e88fe1b4b5833411a43696ebfc62c97
SHA256683b3931465cb1e8e10cafc1ce9579012da1cde8a9e92a3eabe5dada920b12ae
SHA512201b7634d024a6b487d60231b11737bf0e28774aacdc367de58cffb1018f9f72a24f28a5b12694d6fc92de9924f3604bba6628c460eca45d863c581893f7e774
-
Filesize
106KB
MD584c26fff3c97c3d8a4020980d83f14c7
SHA1876f819483e0dfd14c5aaed906edeb8f6d0aa7ae
SHA256bdb55d5b1ef3625d1022c2a4ebfb6463e21cd419fffeba3a4191da6a8c0462fe
SHA5127e54e49a6c1fd59e05a6062ca57cda6b723d56f1a097bfb44187511108823ecba2c7cb4632cfafc22fac73c432ee67e86d8a1768c4d4933ace70a1c43e0a45ca