Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 11:46

General

  • Target

    17747af9c269a5139683b34301029529.exe

  • Size

    3.9MB

  • MD5

    17747af9c269a5139683b34301029529

  • SHA1

    081b2f40014bbc2bbc065e9cd1ffc29fd06151e7

  • SHA256

    c91ee5e59b1885f82d1f65cf4ac86721300ba0aa52d6d917f407bad073a5aea4

  • SHA512

    a6fb83b0887545e75891803827a0bd1bce45eeea77ba8a018253cd187fac8a7177f4dfc4e66db47d895a300a97cbca6c9fb7202857f70d88949182fa65612822

  • SSDEEP

    49152:EQFRHrmQG+yrY+FrBQG+QQG+WQ3+QQGzrmQG+yrY+FrBQG+QQG+WQ3+mQL:EcKHX/GmHX/kk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17747af9c269a5139683b34301029529.exe
    "C:\Users\Admin\AppData\Local\Temp\17747af9c269a5139683b34301029529.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Users\Admin\AppData\Local\Temp\qnhc.exe
      C:\Users\Admin\AppData\Local\Temp\qnhc.exe -run C:\Users\Admin\AppData\Local\Temp\17747af9c269a5139683b34301029529.exe
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\qnhc.exe

    Filesize

    4.3MB

    MD5

    145840826452585ba9c74e5cfd3450df

    SHA1

    42b20b3735ec08cf702b70326f656a29fa884b2b

    SHA256

    71baab39362ceaaf4a5ad97d74241510179f0d9b0b87370c4c3724d9e0165c9e

    SHA512

    29e1a3aeb6000577c785add473ede4b05e46975c956ec8d12616cc6451b5a2c2300d1b94ee111e5455048c07fc9ab5d01eca0c64b44c40c0bee5db5742d7dd7f

  • C:\Users\Admin\AppData\Local\Temp\qnhc.exe

    Filesize

    1024KB

    MD5

    3fd05a7fa391443146009bc19712eb09

    SHA1

    b74d9c7228eb52552d88f4eced731a2c8eafb5c1

    SHA256

    c90b1eb70439eacd4d92fe677967fee78c08bb383ce59f298ea3531d526ae3c7

    SHA512

    1636bbe27aa5b2b0fa6666f8bbd74873765b3dab915a489f8d99825688bae41634a88225e61916cb260a83a1de7ca2e28539eb4f3d2e98cfbeb2b0e5d33c4263

  • C:\Users\Admin\AppData\Local\Temp\qnhc.exe

    Filesize

    2.8MB

    MD5

    7b7aeee780816d1e7cd6dc0ea7a38b94

    SHA1

    3e331192bdd6e72db4bcad405ab1096a18fefa5d

    SHA256

    d6d3abd1fb3becf79cd98f288a2e3d4f643c5814807bc2c2e6ac30c00eb49a30

    SHA512

    6f515a57f3c2c919a11b174152eeaf0fbb9a158dbe7a4fe6ab00d07bd002911155b80296b2fdcaf57ca155dbdb257918cfcf7bf41945559926ba88fa9331515b

  • memory/2520-10-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/2520-18-0x0000000000550000-0x0000000000551000-memory.dmp

    Filesize

    4KB

  • memory/2520-3-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2520-9-0x0000000002B10000-0x0000000002B11000-memory.dmp

    Filesize

    4KB

  • memory/2520-8-0x0000000000390000-0x0000000000391000-memory.dmp

    Filesize

    4KB

  • memory/2520-7-0x00000000002F0000-0x00000000002F1000-memory.dmp

    Filesize

    4KB

  • memory/2520-6-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2520-1-0x0000000000340000-0x0000000000390000-memory.dmp

    Filesize

    320KB

  • memory/2520-11-0x0000000002B00000-0x0000000002B02000-memory.dmp

    Filesize

    8KB

  • memory/2520-15-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/2520-14-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

  • memory/2520-12-0x0000000000580000-0x0000000000581000-memory.dmp

    Filesize

    4KB

  • memory/2520-17-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2520-16-0x0000000000560000-0x0000000000561000-memory.dmp

    Filesize

    4KB

  • memory/2520-24-0x0000000002050000-0x0000000002051000-memory.dmp

    Filesize

    4KB

  • memory/2520-20-0x00000000005A0000-0x00000000005A1000-memory.dmp

    Filesize

    4KB

  • memory/2520-19-0x0000000000590000-0x0000000000591000-memory.dmp

    Filesize

    4KB

  • memory/2520-21-0x0000000002070000-0x0000000002071000-memory.dmp

    Filesize

    4KB

  • memory/2520-5-0x0000000000300000-0x0000000000301000-memory.dmp

    Filesize

    4KB

  • memory/2520-22-0x0000000002030000-0x0000000002031000-memory.dmp

    Filesize

    4KB

  • memory/2520-29-0x0000000002AF0000-0x0000000002AF6000-memory.dmp

    Filesize

    24KB

  • memory/2520-26-0x0000000002040000-0x0000000002041000-memory.dmp

    Filesize

    4KB

  • memory/2520-25-0x00000000005D0000-0x00000000005D1000-memory.dmp

    Filesize

    4KB

  • memory/2520-27-0x0000000002080000-0x0000000002081000-memory.dmp

    Filesize

    4KB

  • memory/2520-28-0x0000000002060000-0x0000000002061000-memory.dmp

    Filesize

    4KB

  • memory/2520-23-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

    Filesize

    4KB

  • memory/2520-30-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

    Filesize

    1024KB

  • memory/2520-4-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2520-2-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/2520-41-0x0000000000340000-0x0000000000390000-memory.dmp

    Filesize

    320KB

  • memory/2520-39-0x0000000000400000-0x0000000000536000-memory.dmp

    Filesize

    1.2MB

  • memory/2520-0-0x0000000000400000-0x0000000000536000-memory.dmp

    Filesize

    1.2MB

  • memory/2520-38-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

    Filesize

    1024KB

  • memory/2916-43-0x0000000002B50000-0x0000000002B51000-memory.dmp

    Filesize

    4KB

  • memory/2916-42-0x00000000023C0000-0x00000000023C1000-memory.dmp

    Filesize

    4KB

  • memory/2916-53-0x0000000000400000-0x0000000000536000-memory.dmp

    Filesize

    1.2MB

  • memory/2916-55-0x0000000005740000-0x0000000005741000-memory.dmp

    Filesize

    4KB

  • memory/2916-56-0x0000000005740000-0x0000000005741000-memory.dmp

    Filesize

    4KB

  • memory/2916-60-0x0000000005740000-0x0000000005741000-memory.dmp

    Filesize

    4KB

  • memory/2916-59-0x0000000005740000-0x0000000005741000-memory.dmp

    Filesize

    4KB