Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 22:08

General

  • Target

    3f0fb4fa09d64d152e2c345152f668ed.exe

  • Size

    759KB

  • MD5

    3f0fb4fa09d64d152e2c345152f668ed

  • SHA1

    b54396c192ef69372fd1d6f9bf1a4b3dbf3d9a41

  • SHA256

    24aad9c501f96eee3604ab467e710703168125d0b69ba618e63bd4f2ec46c552

  • SHA512

    d21fa9402b1cd332c0a91de64a9f92dd09523128ff7a7fdeae728bc77a6ed0e46250445934d66f5d2b4fc1337139d1d8d7d0c69a7e97f830b1214d59c3960364

  • SSDEEP

    12288:Np4xDfr5AsTKV4gZMjHkU+aNiRqtvQ9N0gYzj9+TAYrUaGRrBNvEuAgVaRdLuVsP:NpIDPTY48Mr5wqt48gYxmUas1NvEuAgE

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f0fb4fa09d64d152e2c345152f668ed.exe
    "C:\Users\Admin\AppData\Local\Temp\3f0fb4fa09d64d152e2c345152f668ed.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Users\Admin\AppData\Local\Temp\setup.exe
      C:\Users\Admin\AppData\Local\Temp\setup.exe relaunch
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:2072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    32KB

    MD5

    5b1693f71ff0e6b99b8912c4a41692ba

    SHA1

    0572a7b765ffe7e478dba0ec8963672e3410c5cb

    SHA256

    f0d8fe781ec4214ff5528c55d689f4925b7efd57e203923a5bc3fd283c28d150

    SHA512

    c972122ba83d4932939113f81f96aabeae090b9cd98cc098dd09b8e95413d59df357f4b126fe6a483fca805d4f296fad11451d22f16148c5590320741381aade

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\Local\Temp\Tar16C1.tmp

    Filesize

    85KB

    MD5

    39a86ee0b5cf90f64e836999eb758845

    SHA1

    67c90686a97305b59144c2699a0dfe32f7e419d0

    SHA256

    f6198c383204f5594bb9cb9d2b17c5df53fffe6c81d742e19186ccfa0e0cc2fa

    SHA512

    e34202980b4f8c50d4469e8aff3ed3504a14d1fdc40ad909277a544c0083b5e472019c6baeb3eda94c57ab7c7a8bbd477c49983a793444b1b645c712617b7289

  • C:\Users\Admin\AppData\Local\Temp\setup.exe

    Filesize

    32KB

    MD5

    e953192a01b8434f6984d5463687f976

    SHA1

    d68572e644d996779088120c230c916d359cf794

    SHA256

    2580886bdfcdeed2f07de511e7b23ecbde83c1cd1903561d5603a4b0b2c347df

    SHA512

    563bfc99ece6e9318fcd6b477ee4d1a56720c1cbcdef71fed104afb24178da31031684696ddc6cdfb23b58650ca563af867b0b3b134b9c7615f32a563e9d74b1

  • C:\Users\Admin\AppData\Local\Temp\setup.exe

    Filesize

    55KB

    MD5

    62f60427e84dff60e7b686a668778419

    SHA1

    49d1926f10f1036a3608bc5ff92720f9b8ce4e59

    SHA256

    a8a86885934591186834561688ed4dadd5712e4c6df8063c8f7a6883c6531b75

    SHA512

    5b93d1c5e93fdf703a4e91bc5955ea5b7f113c953268fe05070940788867781ab1eb99718cb9d7d0dce5546cb829b58a6383a4d5fb58afa8c8e4010339ef40a6

  • \Users\Admin\AppData\Local\Temp\setup.exe

    Filesize

    9KB

    MD5

    daa76ada8acfc17727ec30c1ef3aa9b5

    SHA1

    ff41ac06457b67a405c06e1048652ec016aa2742

    SHA256

    6ddcfb57d5fb9c5d1193d306d8d2aeae5bb43a66f13eb95bb2f8dcb229cba975

    SHA512

    8981025f4df80589e892cf177eed50be404080803c107a3797563dfcb14ac5c02df6a612b17a8b486d23294ccca61ba7ee3bafc93202596a18bfaee56195578b

  • memory/2072-81-0x0000000000400000-0x0000000000675000-memory.dmp

    Filesize

    2.5MB

  • memory/2072-82-0x0000000000400000-0x0000000000675000-memory.dmp

    Filesize

    2.5MB

  • memory/2908-0-0x0000000000400000-0x0000000000675000-memory.dmp

    Filesize

    2.5MB

  • memory/2908-4-0x0000000002890000-0x0000000002B05000-memory.dmp

    Filesize

    2.5MB

  • memory/2908-9-0x0000000002890000-0x0000000002B05000-memory.dmp

    Filesize

    2.5MB

  • memory/2908-7-0x0000000000400000-0x0000000000675000-memory.dmp

    Filesize

    2.5MB