Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 23:23

General

  • Target

    1943366f1f3f80a134387769af828546.exe

  • Size

    11.4MB

  • MD5

    1943366f1f3f80a134387769af828546

  • SHA1

    583bdd87062654ccbb1b7ac3a788a5a62e6bb495

  • SHA256

    da8aba5a1bbb963c0c543769395332e030e03ca497ea7ee9a3c969c6ae6c1145

  • SHA512

    6d32754d45cc0a2711b3884c47821a9c7a4939f0e28de6793186429a0d928a1410dfc61c55a75a025fa884a47b45193a3aa92c04bcf98883afb7e0df3dbe7746

  • SSDEEP

    196608:UTwx42RPPBdebEm1iWWHc1SUX6apg3ZhncrJPm59vzgO8L1vsqFRUo7t/IbsCTMp:UaRPiGWW8sUtu/Am5q91vsqFRn5AACT8

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1943366f1f3f80a134387769af828546.exe
    "C:\Users\Admin\AppData\Local\Temp\1943366f1f3f80a134387769af828546.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Users\Admin\AppData\Local\Temp\5274.tmp
      "C:\Users\Admin\AppData\Local\Temp\5274.tmp"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Users\Admin\AppData\Local\Temp\5439.tmp
        "C:\Users\Admin\AppData\Local\Temp\5439.tmp" "install"
        3⤵
        • Executes dropped EXE
        PID:2864
      • C:\Users\Admin\AppData\Local\Temp\5419.tmp
        "C:\Users\Admin\AppData\Local\Temp\5419.tmp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2868
  • C:\Users\Admin\AppData\Local\Temp\5439.tmp
    "C:\Users\Admin\AppData\Local\Temp\5439.tmp" run
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f02bec564006ffa60cb1ff2da7bcd20a

    SHA1

    06a446b690806fe5e28c9194a81da7b5d69ef56b

    SHA256

    5027664ff083d46e3cc0b4a5263f8b05cfa61525c0b4f7710fed4f0c0d3a4080

    SHA512

    c82ef332e98f415d326dc1136fd63f3e3239c582df0825a310b47578a33358269497a8a3fcea55325fa6e698034ec583c984ea4dfd24ea3cb4851158fafbb859

  • C:\Users\Admin\AppData\Local\Temp\5274.tmp

    Filesize

    70KB

    MD5

    ee643c671b52abc43ec9eaa0f1b4509f

    SHA1

    bc8fde57de9ba601204095240adb2c71c6d8325e

    SHA256

    d553e557888d6015cb148e08271fb78f5a493d00188235344e740d8f8d340be4

    SHA512

    b070833dc05c3a9aff93ffec31a833b484cf8a8e750c0804c90a9d58355f714b2fb13530f6b6a948851534ce07e41c380e4b18ebbabcb847643243e1980e8cf1

  • C:\Users\Admin\AppData\Local\Temp\5274.tmp

    Filesize

    90KB

    MD5

    4e6ceb37f4109211ebb2999f83a97028

    SHA1

    1d4d2be96b04d10f9f8b152fb59fa95c1adde06d

    SHA256

    d61c9b53467846748ec147328c0afab8e8072144bbc5e074bd28cd584d69c8bd

    SHA512

    e15e424f8e28e3a32a70d4d099bd1df2a7a073fb806961ed71843d33936531bff01e9c1b93e9eb8e193be2d2e39941ce49004459e4afb364fbeb2a247dfc81fb

  • C:\Users\Admin\AppData\Local\Temp\5274.tmp

    Filesize

    34KB

    MD5

    47c868b018a2456976457d1d1c465bcf

    SHA1

    4eb65eff8ab17be3b55cda12ba64dfee5046acf0

    SHA256

    a1d85f54ebc0f43f63fe1287524d614d9cb8944f3211f679e459324030b78973

    SHA512

    a6dbbdbfa0cd15493a901a5bb620235ad3c8f462f0a1ef79f5539921980d0b2261fbc7dda1e934b3e22b919d9beb1a83642068c7e8a9faaf7b49593db933a2a0

  • C:\Users\Admin\AppData\Local\Temp\5419.tmp

    Filesize

    170KB

    MD5

    cc7f0363afedc16668e085749c65c697

    SHA1

    3bfaf1e1bb014e8ea33b222ecb41edbfdfa91068

    SHA256

    2a8fbba82835053d5901f020b9a5a475c2c5a8b15b8cee2b3d3f294470c85c73

    SHA512

    b699ad01c9e8342aaab7de3bf1f72331d97e5cebb6c36404a63463712a413be2ada6d4f0b14f0c64c147b51cae426d5c982a6a2a87ff3ccea6ed14192d2702a1

  • C:\Users\Admin\AppData\Local\Temp\5419.tmp

    Filesize

    231KB

    MD5

    908d81d408f3c10ab30ab1c0b8e78cee

    SHA1

    efd3fa36da9ff4df4c0845ebe908061aa44a5544

    SHA256

    4854c0fe620d3815f5e0972e77aff0b9ac31fad6978e188c0099d5fb84b73b0d

    SHA512

    d99e5d6974c381dc9cd0e8b31fefe497f71cfa2a627ba0198f7cc60086c14b140c1908597f69adbd46075250fda79762f4d71cdcc1df85ec396cdd76e664b53c

  • C:\Users\Admin\AppData\Local\Temp\5419.tmp

    Filesize

    99KB

    MD5

    fb82f9e9c27a84eecf672bbcd9d842bc

    SHA1

    ffbcc634646e5b9a69569ae8249dc1f5ca0685cb

    SHA256

    8987bf5053fc6d1e8ad1c255888fd622af7fcadce505c324ebb6428590e15ac0

    SHA512

    cfce48f1b34c6df96333d94c451e3eb81305f8893a04df8b6b57179e4c37008ebc417d974c7ade00f921e8148e71590c2d3176b403e42e942a82aabaa7057d9d

  • C:\Users\Admin\AppData\Local\Temp\5439.tmp

    Filesize

    232KB

    MD5

    220e4b0bcdcdee3f219e5cf676a390af

    SHA1

    d959c5d8a69cbd81ef03d203dde99d4cd2cd4197

    SHA256

    b83916a2b6f32eb1fe111955427598834aa65166427671d35a7969524e94c358

    SHA512

    90f2867f76ced8d2fdb16fe666d7e37ace970380fdd74de39620ca7554c57feb991b8f90162a7fe1459221cd6ec8b656a3e97e77b880a69a98d1f4adb3eaf185

  • C:\Users\Admin\AppData\Local\Temp\5439.tmp

    Filesize

    86KB

    MD5

    38952f58f10ef1773d603758484dc858

    SHA1

    94b2164f7d7c0aea243f5a6d7ce14926563f0f7a

    SHA256

    3d9ac29eddff2780e7f3b7fcba8c8b611644caed301b59f5c78994fd765dc911

    SHA512

    cded3cb79cddb72287410b107019e4caac19188f9d1cfc4f6b59d4c43fe445457f2dd036c57f83dbb3b292c5f487a88eee201464fd8d5af2257ef7271058c9d7

  • C:\Users\Admin\AppData\Local\Temp\Cab824E.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar8D0A.tmp

    Filesize

    43KB

    MD5

    91c71861c4c0fff27b979cf1305869a6

    SHA1

    1ca9e5edfbcbd64d5f05b820f8c03ad79becdff6

    SHA256

    305d4e4d69512158810c3274ef77ad2af48c34002ec20b352d1a1d6574115249

    SHA512

    d97d8dfa6a8f8cb21b7de6a393295b5f9950b77a2b0a04005d8b22472d06e3a7bc18dc4d08a4826aa274769555b4b1e9947daad6c7b516b3ee009084a2cb4f68

  • C:\Users\Public\Desktop\Чистилка.lnk

    Filesize

    1KB

    MD5

    c658908ecf605515416768b1aff80289

    SHA1

    bb71e6d8bad58a388b549bedcca0ffe092e0a0f8

    SHA256

    9e87f3b59ba14422a264e6b37f9cf95c29b68a4dcf9b5684c5aa02d4b3fdb170

    SHA512

    116cb243db6c1d087ce6b822001a3679c0a14ee11886728b200ee9aa6b84b1bf98aaab364db2046e58dfc233d01862c94d81db805efb2df95ebe027c82793743

  • C:\Windows\Fonts\pns.ttf

    Filesize

    127KB

    MD5

    df8c626474a73ab7a8b511655597c7c4

    SHA1

    5de28f387ea88553d195d1978286d43c33231969

    SHA256

    723091ba5a1b8e65164075516d69c00c71225c6dde61ffc32dd4047803ab42b5

    SHA512

    c8f7d1577cb70610c40b96c835faca6b916c4924b5061351c8a67287567556b2014efb7c73cdcc4fb6533829541cd0264b8a9e428d3c572e29c06b0d96633d59

  • \ProgramData\Чистилка\Чистилка.exe

    Filesize

    91KB

    MD5

    658e5e6cede79b9794690682a0eafbf0

    SHA1

    bb62af90c44579390e35f43dc090a05d6d550d91

    SHA256

    37fd02f902835b5ff3121be9a822af7e99c7fdfe2ada0154c2e5e04e20e36855

    SHA512

    a9bd4de1b1bb6c8459b7f727e28502cdf79fb89d896e88b14d7f39ccabd5c9dbf471083c91179c6e13658fe0cd34deaadac7356fa89257aee63de088f64b4799

  • \ProgramData\Чистилка\Чистилка.exe

    Filesize

    69KB

    MD5

    a55e09333dafa187468fa9fa0860b3c7

    SHA1

    dc2c1143064985c3a817ce2ae34bb5d52f7d81a5

    SHA256

    ec8e835289ae1ed1f8fc8995b8a3c20650ff3be4e74f7c3c3a50c525f36d043c

    SHA512

    eca735ddba16e833a6b78246fadc091d42479ea38709d3771850968f3763977a5f54cc7af924a544fa36d6844e23ff616e1a843ac4c9ea3e7602a92ccc008bb2

  • \ProgramData\Чистилка\Чистилка.exe

    Filesize

    62KB

    MD5

    66a3734ac39197c5e9d3a148653b99c3

    SHA1

    2aa55bff7cc1db5f1655b9a3ddbd44e6709f315c

    SHA256

    c0e88f23b668a20d4e691bb7ebad54ae06c193329f553de8e65c587210bd9eff

    SHA512

    68d2ecc25005894d302c6d32d169b2579e56999bd8f714b26ae0af75779f50f2c5f3c43147673839d86fa6e478f068e203b7dea635239601065303355272557b

  • \ProgramData\Чистилка\Чистилка.exe

    Filesize

    124KB

    MD5

    f9aabbfbcce29be73dd63c4e31b927ae

    SHA1

    a5db98a10741ceeac35aa6036271631385ca3479

    SHA256

    1b25be3b07ec2adb08acc15a659a6c5765bb28d92c458e0ab3e9650f40b66440

    SHA512

    a28319755aeae08b23c370a96cfe668ce40fb069750df00398ae431810d58aa76d196a076fa12e09df1123e569136a9d62b42a9d19a31a56cb08e4cc2a1f46d6

  • \ProgramData\Чистилка\Чистилка.exe

    Filesize

    64KB

    MD5

    b22998a86e5ff723244b4379c5e6543c

    SHA1

    40d118855cc5196b24387f1ed25e0c0cecad4a4f

    SHA256

    9405c33f4f4b2b0736041fac4b5c656317c7330c97f15c02def475bdbf9b2e16

    SHA512

    0f8d770745e7feb500284e4925a35dbc7b487b047883f570fb103401d618d9440a27af09fe9e3dd3b42bc41e746beb009b1e91c83ade1d1ffaa6958d546160d2

  • \ProgramData\Чистилка\Чистилка.exe

    Filesize

    92KB

    MD5

    2027b7309f4c7baf9414004a5f1f5dc3

    SHA1

    b4f062dbfa4df84704e42290edb5202ca4f2b34c

    SHA256

    623ecf69c790ad4f2aac2b93fedebfb01407ed8e40ab8b1b8cd2e4f384df6aae

    SHA512

    e6572c1c5bca8e42c2304dca1a76816229a140aa108c7fe144529f119641b43c76da53db8976364c6a2f6b4ca6ce8200ca6fc37c9ad0cd882482d46805975baa

  • \ProgramData\Чистилка\Чистилка.exe

    Filesize

    122KB

    MD5

    b8e29dde64198b21a97a6c12946bf5f0

    SHA1

    4b89799f046199b975046d1fc13931258b619308

    SHA256

    9cd12137711c0e18b61814681f299bb4d770b7282a39dc17e159101eeee28883

    SHA512

    72fd2e77d01d36eb2ea522c6a84c2dfe556643889138e9fffa8c010474b192f02f79f2273a400ee3063665b5a2da1740fa25e9f47799e27d5549305d53bf21f0

  • \Users\Admin\AppData\Local\Temp\5274.tmp

    Filesize

    45KB

    MD5

    3fd7234a1413e3b9126ca78700d29c9c

    SHA1

    a24c5b32bcdc97e9475e44a9e16d10dfb839aba2

    SHA256

    ffad57c3de3859b1861640162d7124633ae9bd33af3a0fe27a7113aba0714887

    SHA512

    e83276c766b4cdafa4f3e064fc841d7c165d86feac5b22391a2e59b69d3a6375c08ee47b44f8686a77db871314fcdc25f3c0e59b249b8b007861afceeca412ab

  • \Users\Admin\AppData\Local\Temp\5419.tmp

    Filesize

    299KB

    MD5

    ff52ef2750f84f91ef005ffbeb5458ec

    SHA1

    f0684c3e172adb7387c4c8e33e63834675ea895a

    SHA256

    54831ca4a09e976a6fb3767cf780454ababb07c3a06c33ed8957a818db65758b

    SHA512

    06376dafacff2ceda217c3a5d5eaf3afedd206cbb0902511997fc657347e7f6f4718fd2bb31aec3285e2f56dc64ca1b83a8dab6877dd515d80a37e80cffd85ad

  • \Users\Admin\AppData\Local\Temp\5439.tmp

    Filesize

    202KB

    MD5

    0f91ea48caff93358eecff65608593e5

    SHA1

    f86fecb21e88fe1b4b5833411a43696ebfc62c97

    SHA256

    683b3931465cb1e8e10cafc1ce9579012da1cde8a9e92a3eabe5dada920b12ae

    SHA512

    201b7634d024a6b487d60231b11737bf0e28774aacdc367de58cffb1018f9f72a24f28a5b12694d6fc92de9924f3604bba6628c460eca45d863c581893f7e774

  • \Users\Admin\AppData\Local\Temp\sciter.dll

    Filesize

    106KB

    MD5

    84c26fff3c97c3d8a4020980d83f14c7

    SHA1

    876f819483e0dfd14c5aaed906edeb8f6d0aa7ae

    SHA256

    bdb55d5b1ef3625d1022c2a4ebfb6463e21cd419fffeba3a4191da6a8c0462fe

    SHA512

    7e54e49a6c1fd59e05a6062ca57cda6b723d56f1a097bfb44187511108823ecba2c7cb4632cfafc22fac73c432ee67e86d8a1768c4d4933ace70a1c43e0a45ca

  • memory/2868-76-0x00000000008F0000-0x00000000008F1000-memory.dmp

    Filesize

    4KB

  • memory/2868-174-0x00000000008F0000-0x00000000008F1000-memory.dmp

    Filesize

    4KB