Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 07:06

General

  • Target

    11b838aafbea231e6d9ac7b4cd578b83.exe

  • Size

    1.4MB

  • MD5

    11b838aafbea231e6d9ac7b4cd578b83

  • SHA1

    1517d0b4608754311f7afcf82e347a765f79ac8f

  • SHA256

    0488a07343371881b2d6b461e0c21403aab39b8fbe669814ed70c850ec4eebe1

  • SHA512

    a185fd320dbfcfd8a39cfdfc26fb906807aa0f37b62aae676b98db424c3c4c3e42243ab75ccb4b89e1bd4e6ed4cb04eb50698935bd9b3ad163d580c7f673be54

  • SSDEEP

    24576:2FRukAzt8uSHp8X9V0ESdQpglO1CxDyawn27h+9hrlgKQY9SGcZwCdTp:G0k2t8TmX9V0RIglO1CuL9VNcaCd9

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of SetWindowsHookEx 37 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11b838aafbea231e6d9ac7b4cd578b83.exe
    "C:\Users\Admin\AppData\Local\Temp\11b838aafbea231e6d9ac7b4cd578b83.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Windows\tmp.tmp.tmp1
      C:\Windows\tmp.tmp.tmp1
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:3052
    • C:\Windows\ResHacker.exe
      "C:\Windows\ResHacker.exe"
      2⤵
      • Executes dropped EXE
      PID:2972
  • C:\Windows\heqlh.exe
    C:\Windows\heqlh.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    PID:2624
  • C:\Windows\appl_.exe
    C:\Windows\appl_.exe
    1⤵
    • Executes dropped EXE
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetWindowsHookEx
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2596-65-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2596-61-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2596-47-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2596-98-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2596-33-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2596-77-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2596-74-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/2624-48-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/2624-44-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2624-63-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2624-42-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/2972-13-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2972-45-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2972-46-0x0000000000400000-0x00000000004DD000-memory.dmp

    Filesize

    884KB

  • memory/3004-43-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3004-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3004-20-0x0000000003A40000-0x0000000003B41000-memory.dmp

    Filesize

    1.0MB

  • memory/3004-4-0x0000000004060000-0x0000000004B1A000-memory.dmp

    Filesize

    10.7MB

  • memory/3052-32-0x0000000002050000-0x00000000020A7000-memory.dmp

    Filesize

    348KB

  • memory/3052-21-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/3052-41-0x0000000000400000-0x0000000000501000-memory.dmp

    Filesize

    1.0MB

  • memory/3052-31-0x0000000002050000-0x00000000020A7000-memory.dmp

    Filesize

    348KB

  • memory/3052-22-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB