Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 10:44

General

  • Target

    164d6a636417f34658a3cff67ad526f3.exe

  • Size

    1.1MB

  • MD5

    164d6a636417f34658a3cff67ad526f3

  • SHA1

    60f906ca657cac46b34d903ffd0127c42130c42c

  • SHA256

    1c760857e861e7a69e3a01cdc1bd3cd5fe8d4de8b5027025a59888ae713b71bf

  • SHA512

    d3298fd9ce701214ff450590ad9a131dcb699025394c2e0769958151e9be77395bf0d68b2451a32041e75b83eedc54d8aa84dfab123577fa9c6d82bf011946eb

  • SSDEEP

    24576:Dr2fMLQ6gSy8Q7BiNL+VElHA1dHdQ0aKMrzws1Ztf3vw:v2EUOQdiNiElHAbdoKUwsVf3vw

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\164d6a636417f34658a3cff67ad526f3.exe
    "C:\Users\Admin\AppData\Local\Temp\164d6a636417f34658a3cff67ad526f3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe
      "C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe" boAPg04Yheavj8SmXRBU 962
      2⤵
      • Executes dropped EXE
      PID:1628
    • C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe
      "C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe" IC9UaWNrZXQ9Ym9BUGcwNFloZWF2ajhTbVhSQlUgL0J1bmRsZXM9MTYzfDE0NXwxMzR8MTYyIC9PYmVyb249MCAvQnJvd3Nlcj0zIC9BZExvYz05NjIgL3RwZD1odHRwOi8vZDEuYXJjYWRleXVtLmNvbS9hai9idW5kbGUvOTYyLz9wPU9UWXdNalE0TURjNU1YamNkenpXbTJHNUlITk9GaHo1TWd3bnpubnp5aHZ6UmRFTFFvbiUyQiUyQjJ6OWZPV00wTiUyRnpCdk00R3g5bXpTcUVVY0JzcG5aMnMlMkI0WiUyQmhZTGNTN1dhWlklM0QgL29wdGltaXplR0M9MCAvdXNlck5hbWU9QWRtaW4gL3VzZXJTSUQ9Uy0xLTUtMjEtMjQ0NDcxNDEwMy0zMTkwNTM3NDk4LTM2MjkwOTg5MzktMTAwMAo=
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3ee3f02d9b12445413cb82eda6abb915

    SHA1

    a29d070cd02375c65d5595d258109303cefcfac7

    SHA256

    e568aa16edf173c487aa46eb8910bbd2e78341f739a177a22ef83ed284e226d0

    SHA512

    1a06547dbeba4130f2c387551d5b801db0ed7faeb1d61fd371e88b5a7d2b199f707f87abaf3ecfe1667e798a7a895c71d1c626749684844fb72d7ef0f8b74674

  • C:\Users\Admin\AppData\Local\Temp\CabE34F.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar12EA.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe

    Filesize

    883KB

    MD5

    1df9cb2785075f2738d8bdb876831731

    SHA1

    4a3048ba67f8b2529846e51cd0e7793f63f20ae3

    SHA256

    8459860387ea51a7d83e817f72d46f4eeaade8ec4414c89843676dc29d4496d9

    SHA512

    9209c7aac280b00905432be6d1f592c8fa99b6bbbc112297a0273d761d5c75d90e836bb66823181cf563df645b34e022f755e865f5d07b5588e1688d8476d330

  • C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\ArcadeYum.exe.config

    Filesize

    231B

    MD5

    ae437dea18c61477cc2f17f46fb11d01

    SHA1

    94afba8148c6072ad60c6899ed717005681e9da5

    SHA256

    d8966d4c96ba3c910f86c44d6d7b6c298cc70cc3c5c61bb975861eed846b0754

    SHA512

    61ad33f07fbb65863f1eb02a14230c38766fbb5e1fe4263433ecd32375249e7af71e49f054e5f919884f5250dccf95fb6791ceeadf3c2d4cb468ba5af3e8902b

  • C:\Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\config.cfg

    Filesize

    74B

    MD5

    8de01189302350da92f59ff02990a92a

    SHA1

    ce54eefc50d961727f3ed2e543803524b70e1bab

    SHA256

    74c04c9da8794eed50ecf3f7cec66078d6d8351162858027cfa43eb9f716b477

    SHA512

    1eded2fd7bf942fefcc3e9bf1ef06c002dad26372c8bf401c4ba000eb8b9bc236e098f5ed364c3360e079ad59fdf85c76095304cc78919a3a24d818375411fa3

  • \Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe

    Filesize

    907KB

    MD5

    6a1211294ecd5f0e2808ad153d24e3d9

    SHA1

    94f3a1303eed2580af2f49c080cc7a930159945b

    SHA256

    bd69ea9f8b5af4fd1b8da533c5439c3ed7cdda3925df54d08bde2b6cad3475cb

    SHA512

    ee6ea802dff2615c65c2601d5dc7b4addfebb81c4d1fbcba6ff4cdcf7b2b818104064cb1c9af058567202de6619d04f5512dada185e3058d10988cfc8c8cadc8

  • \Users\Public\Documents\{8C1A49E6-2F7F-40E3-923F-5DE549CAF021}\starter.exe

    Filesize

    1007KB

    MD5

    a0865a8429851042ede865187a5d6eeb

    SHA1

    1a71a4301d305a1cdacfd4c18acd6a057bd4cf44

    SHA256

    ebb4713a230340735681433fc87be0e46ab2db19ef395276a573086e45a631c2

    SHA512

    e20e286ca064ef84ac2f18450894c46d162af00c263b25a19f1d685769e1780a48961faf1397ff819bca2f2880759f7a7e86dc3d5b080b91e8afe164409bda42

  • memory/2808-23-0x00000000742A0000-0x000000007498E000-memory.dmp

    Filesize

    6.9MB

  • memory/2808-26-0x0000000004900000-0x0000000004940000-memory.dmp

    Filesize

    256KB

  • memory/2808-29-0x00000000742A0000-0x000000007498E000-memory.dmp

    Filesize

    6.9MB

  • memory/2808-30-0x0000000004900000-0x0000000004940000-memory.dmp

    Filesize

    256KB

  • memory/2808-25-0x0000000004900000-0x0000000004940000-memory.dmp

    Filesize

    256KB

  • memory/2808-24-0x0000000004900000-0x0000000004940000-memory.dmp

    Filesize

    256KB

  • memory/2808-22-0x0000000000950000-0x0000000000A32000-memory.dmp

    Filesize

    904KB