Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 07:22

General

  • Target

    0e6d064a2367fc710df5d7783aa9e918.exe

  • Size

    237KB

  • MD5

    0e6d064a2367fc710df5d7783aa9e918

  • SHA1

    9fd67948f04435bf7a87dfc84c5590b36a6d9f1d

  • SHA256

    5b549a718d3f01a3566830660c5bb433a59ae2524bfc7be0d9ab2b43a618c6e7

  • SHA512

    94aba068fc77dcfdcfd0b4f3c5e64943cb29b75f21b5b9100aa5e4b7964ee89aca38e5b5aa0d6b80ee2565b142be6187c976b8a63f21f41a1a642205f818a5a4

  • SSDEEP

    3072:HwxVMhOC/dTDbq91+mno3t4QZQ3rbTn7kknpLWFccNWwN203C0qEf81ePBxhYNZa:HTfFDbRnOTrbTZpu1N2FhU81ALhYPLzS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\0e6d064a2367fc710df5d7783aa9e918.exe
        "C:\Users\Admin\AppData\Local\Temp\0e6d064a2367fc710df5d7783aa9e918.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1792
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\beli.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\beli.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2080
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\beli.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX0\beli.exe
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:812
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:2276

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\2084629367_9.jpg

      Filesize

      56KB

      MD5

      9d25676d4c96e190562aa4c9d7854849

      SHA1

      f2ceab7fdc8b36dc94574c081b10fa5820df67fe

      SHA256

      897dca7cad3d0b9dc60b68c17e4d77cd15de3fcd96da8c94e6fa63e8fb815a26

      SHA512

      c71a1b405704f043082769525fb8a49f7a29ce3cdb4c03951418ccfa822f5cb5d4fc7361013e26abdbf02a114f28f1a1e6075ff02d87033d24c87b7ce37d8fd1

    • \Users\Admin\AppData\Local\Temp\RarSFX0\beli.exe

      Filesize

      64KB

      MD5

      da0869d2d78d5ae73d31988ecb1a4d06

      SHA1

      eef3679cba5046e1d999a5cc3e9379bc26ebc618

      SHA256

      ed683234d4e63791bec26598624c524b1815fc40902300e69da8fdc72c073f1e

      SHA512

      e5b723dfa4fb3346736c82c5412fa2f671216d1675060ed1ee720d2e99f669b2147ec9581f4747f795218feb4a92cd5e75f0ed4c6be8697081bc85a3336531b6

    • memory/812-28-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/812-20-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/812-19-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/812-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/812-38-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1200-25-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

      Filesize

      28KB

    • memory/1200-29-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

      Filesize

      4KB

    • memory/1792-21-0x00000000036B0000-0x00000000036B2000-memory.dmp

      Filesize

      8KB

    • memory/1792-40-0x0000000000400000-0x0000000000423000-memory.dmp

      Filesize

      140KB

    • memory/2276-22-0x0000000000140000-0x0000000000142000-memory.dmp

      Filesize

      8KB

    • memory/2276-23-0x00000000003B0000-0x00000000003B1000-memory.dmp

      Filesize

      4KB

    • memory/2276-41-0x00000000003B0000-0x00000000003B1000-memory.dmp

      Filesize

      4KB