Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 05:37

General

  • Target

    0882034042f4b2c2d9ea830a30536054.exe

  • Size

    95KB

  • MD5

    0882034042f4b2c2d9ea830a30536054

  • SHA1

    909a542a46057eb46fe48ff40b6c0d6157f102bf

  • SHA256

    4ee3c4ed238e0b65b0e03e41c1ffe9c4317666dc5841fe8221756b4dd56466b9

  • SHA512

    0fb1fc5bb796db23b2d4d4f1b996af907545a722f78a17d56269048797ce20390396af98aa2fd3ba8b7ae421412cc34d09acb40b92a3a3bc71b7166fce35d99a

  • SSDEEP

    1536:gtWIGeD2IeDULK4QntaHnO0vRNfldcO3IuCbpZXsH2zhEw2GZsLAPd+9YQLeuhdP:JIB304QV0vRNfldc+wbzuYSw/sYd+9HH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0882034042f4b2c2d9ea830a30536054.exe
    "C:\Users\Admin\AppData\Local\Temp\0882034042f4b2c2d9ea830a30536054.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\winsys\9DDCFF4D6D4.exe
      "C:\winsys\9DDCFF4D6D4.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2420
  • C:\Users\Admin\AppData\Local\Temp\A9HC8EA.exe
    "C:\Users\Admin\AppData\Local\Temp\A9HC8EA.exe"
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\A9HC8EA.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • C:\winsys\1715BBD1D4E4D30

    Filesize

    4KB

    MD5

    db4994dec26adf9d09a9bab24a2dcca8

    SHA1

    2535863a5e35952b2dabc8068fc139aa0c87a7ab

    SHA256

    a298f8b9708d98dfa473426493d6b5d87b58938defab1e3ff7ecfa7adcff1f4e

    SHA512

    71db8ef68660d57c08f135d56fe506ea824a601b3df4e369a0780ec5a58f9480aa2f7a9d5b00a508439b82d92418c20a741807190226066fd15c8a39ff26e5de

  • \winsys\9DDCFF4D6D4.exe

    Filesize

    95KB

    MD5

    0882034042f4b2c2d9ea830a30536054

    SHA1

    909a542a46057eb46fe48ff40b6c0d6157f102bf

    SHA256

    4ee3c4ed238e0b65b0e03e41c1ffe9c4317666dc5841fe8221756b4dd56466b9

    SHA512

    0fb1fc5bb796db23b2d4d4f1b996af907545a722f78a17d56269048797ce20390396af98aa2fd3ba8b7ae421412cc34d09acb40b92a3a3bc71b7166fce35d99a

  • memory/2420-20-0x0000000001100000-0x0000000001158000-memory.dmp

    Filesize

    352KB

  • memory/2420-41-0x00000000009D0000-0x0000000000AE0000-memory.dmp

    Filesize

    1.1MB

  • memory/2420-39-0x0000000000210000-0x0000000000256000-memory.dmp

    Filesize

    280KB

  • memory/2420-37-0x0000000001100000-0x0000000001158000-memory.dmp

    Filesize

    352KB

  • memory/2420-25-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2420-23-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2520-99-0x0000000000070000-0x0000000000071000-memory.dmp

    Filesize

    4KB

  • memory/2520-127-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-7-0x0000000077E4F000-0x0000000077E51000-memory.dmp

    Filesize

    8KB

  • memory/2520-5-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/2520-65-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2520-4-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/2520-19-0x0000000001100000-0x0000000001158000-memory.dmp

    Filesize

    352KB

  • memory/2520-8-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2520-2-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2520-3-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2520-0-0x0000000000330000-0x0000000000388000-memory.dmp

    Filesize

    352KB

  • memory/2520-146-0x0000000076D00000-0x0000000076E00000-memory.dmp

    Filesize

    1024KB

  • memory/2520-98-0x0000000000070000-0x0000000000071000-memory.dmp

    Filesize

    4KB

  • memory/2520-105-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-103-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-64-0x0000000000330000-0x0000000000388000-memory.dmp

    Filesize

    352KB

  • memory/2520-108-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-71-0x0000000000390000-0x00000000004A0000-memory.dmp

    Filesize

    1.1MB

  • memory/2520-80-0x0000000001100000-0x0000000001158000-memory.dmp

    Filesize

    352KB

  • memory/2520-13-0x0000000001100000-0x0000000001158000-memory.dmp

    Filesize

    352KB

  • memory/2520-131-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-133-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-139-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-129-0x0000000076D00000-0x0000000076E00000-memory.dmp

    Filesize

    1024KB

  • memory/2520-120-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-119-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-118-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-117-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-116-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-115-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-114-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-113-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-112-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2520-111-0x0000000077E4F000-0x0000000077E51000-memory.dmp

    Filesize

    8KB

  • memory/2520-83-0x0000000077E4F000-0x0000000077E51000-memory.dmp

    Filesize

    8KB

  • memory/2520-1-0x0000000000390000-0x00000000004A0000-memory.dmp

    Filesize

    1.1MB

  • memory/2520-106-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-87-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-148-0x0000000076E10000-0x0000000076FD4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-102-0x0000000002790000-0x00000000027C5000-memory.dmp

    Filesize

    212KB

  • memory/2852-97-0x0000000000210000-0x0000000000256000-memory.dmp

    Filesize

    280KB

  • memory/2852-96-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-95-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-92-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-91-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-89-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-88-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-109-0x0000000077E30000-0x0000000077FB0000-memory.dmp

    Filesize

    1.5MB

  • memory/2852-86-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-110-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-82-0x0000000076D00000-0x0000000076E00000-memory.dmp

    Filesize

    1024KB

  • memory/2852-126-0x0000000000D60000-0x0000000000F24000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-79-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-77-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-76-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-75-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-74-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-72-0x0000000077E51000-0x0000000077E53000-memory.dmp

    Filesize

    8KB

  • memory/2852-70-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-124-0x00000000001A0000-0x00000000001A5000-memory.dmp

    Filesize

    20KB

  • memory/2852-68-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-67-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-66-0x0000000077E51000-0x0000000077E53000-memory.dmp

    Filesize

    8KB

  • memory/2852-107-0x0000000077E30000-0x0000000077FB0000-memory.dmp

    Filesize

    1.5MB

  • memory/2852-63-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-62-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-60-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-61-0x0000000000D60000-0x0000000000F24000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-54-0x0000000000210000-0x0000000000256000-memory.dmp

    Filesize

    280KB

  • memory/2852-50-0x0000000000210000-0x0000000000256000-memory.dmp

    Filesize

    280KB

  • memory/2852-104-0x0000000075B10000-0x0000000075B45000-memory.dmp

    Filesize

    212KB

  • memory/2852-149-0x0000000076E10000-0x0000000076FD4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-147-0x0000000002710000-0x00000000028D4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-145-0x0000000076E10000-0x0000000076FD4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-150-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-151-0x0000000076E10000-0x0000000076FD4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-94-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-90-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-44-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/2852-43-0x0000000000210000-0x0000000000256000-memory.dmp

    Filesize

    280KB

  • memory/2852-85-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-40-0x0000000000210000-0x0000000000256000-memory.dmp

    Filesize

    280KB

  • memory/2852-81-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-78-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-73-0x0000000077E4F000-0x0000000077E51000-memory.dmp

    Filesize

    8KB

  • memory/2852-32-0x0000000000210000-0x0000000000256000-memory.dmp

    Filesize

    280KB

  • memory/2852-69-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-59-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2852-52-0x00000000001A0000-0x00000000001A5000-memory.dmp

    Filesize

    20KB

  • memory/2852-48-0x00000000001A0000-0x00000000001A5000-memory.dmp

    Filesize

    20KB

  • memory/2852-46-0x0000000000210000-0x0000000000256000-memory.dmp

    Filesize

    280KB

  • memory/2852-42-0x0000000000210000-0x0000000000256000-memory.dmp

    Filesize

    280KB

  • memory/2852-38-0x0000000000210000-0x0000000000256000-memory.dmp

    Filesize

    280KB

  • memory/2852-152-0x0000000076E10000-0x0000000076FD4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-154-0x0000000075B10000-0x0000000075B45000-memory.dmp

    Filesize

    212KB

  • memory/2852-155-0x0000000002AE0000-0x0000000002CA4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-156-0x0000000077E30000-0x0000000077FB0000-memory.dmp

    Filesize

    1.5MB

  • memory/2852-153-0x0000000002790000-0x00000000027C5000-memory.dmp

    Filesize

    212KB

  • memory/2852-159-0x0000000002AE0000-0x0000000002CA4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-161-0x0000000002AE0000-0x0000000002CA4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-160-0x0000000002AE0000-0x0000000002CA4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-158-0x0000000002AE0000-0x0000000002CA4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-157-0x0000000002AE0000-0x0000000002CA4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-162-0x0000000076E10000-0x0000000076FD4000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-163-0x0000000076E10000-0x0000000076FD4000-memory.dmp

    Filesize

    1.8MB