Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

3975ff2aa7...8c.exe

windows7-x64

8

3975ff2aa7...8c.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    214s
  • max time network
    227s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 19:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3975ff2aa7b5d7b9e15c411bf1501c8c.exe

  • Size

    20KB

  • MD5

    3975ff2aa7b5d7b9e15c411bf1501c8c

  • SHA1

    b5555fb6bda3ddc24924c49c254a6d6e44a82ba3

  • SHA256

    4d8ee5361e4b6544235d0664b01974807032fbe6b801272b00387c7095284ce5

  • SHA512

    cc1e412cbabfe02a8bd76aadb5bd649b46ccba8be5dbeaa62f611c89acfa35beaf1c2bc2dad867335ebe566ef5e39a0301901978a9af849ca314921b9275d28d

  • SSDEEP

    192:1l5E3krTuntKy0peHDfCpHfBv+I4QwXt9V+jqu0G5KDJBWXhg:1M3PnQoHDCpHf4I4Qwdc0G5KDJ8g

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 6 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3975ff2aa7b5d7b9e15c411bf1501c8c.exe
    "C:\Users\Admin\AppData\Local\Temp\3975ff2aa7b5d7b9e15c411bf1501c8c.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Executes dropped EXE
      • Drops autorun.inf file
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:1504
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\AE 0124 BE.bmp
    Filesize

    40KB

    MD5

    a405021b3ba543277f46cdfdb23ee51b

    SHA1

    2a325fc37598c4518453157123db355b4ad240b9

    SHA256

    eecaea8f93c3ad88053d6f7435bdc477a3d571de879d06b94c6108f11b05ed6c

    SHA512

    b3a28318540579ae26a50b1fdacd8aecb1a12f956b3c6713ba4ecdac68634a2db51a86db7aac0d89a000851f3e90e141e20797e4ad46dd19798e2819c813f77d

    Download Submit

  • C:\Windows\SysWOW64\drivers\MSVBVM60.DLL
    Filesize

    1.2MB

    MD5

    5078666bc51a7d8e49a2666b0228c075

    SHA1

    1eda2fdba0d5d70170ae9f5f8e4831bf383568fb

    SHA256

    dfbb8e4860e5c4d0da00621bcc97c63fbdf50aabc7843f77739f3b50de3bf36c

    SHA512

    1646ff8af7bc9301571bfed26a5cc3dbc64334c989072a3e76bcc025a420248fa641627b607562f96e3601bba8cff79f63b0e439e615ba2a3aa4036153a0a113

    Download Submit

  • C:\Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    40KB

    MD5

    b4eb44cef0dac9767ea5077c089e331c

    SHA1

    6de110c656f61278df3657d897e1187d014aa2c3

    SHA256

    6ce7d15fbc50c4add0582ca47b5ce8ffe53ad5ea347c345ad7e3f9d668b342fa

    SHA512

    f21c4733a7a8e67abf95a573660c5822b3a5382db692162bde399fef3438ff685a8e9d9fdd009fd0a5d6cc007f7e4dd0a024a2d1e78b9de5800df8caa27219b3

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    25B

    MD5

    589b6886a49054d03b739309a1de9fcc

    SHA1

    0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

    SHA256

    564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

    SHA512

    4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

    Download Submit