Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

29/11/2024, 09:11

241129-k5pcssxkew 10

29/11/2024, 09:11

241129-k5kdvaslhk 10

30/12/2023, 12:12

231230-pdbpvaegdr 7

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 12:12

General

  • Target

    winer/Winner_Free.exe

  • Size

    6.3MB

  • MD5

    babd90df8276efdedb7a0510d6d6e8aa

  • SHA1

    9a43619fea06385a32a8bda7f125c834b7824f0a

  • SHA256

    925840c7fa54b3bd5f8df5ed843d6872e30c95b423b10dedf6c6f56ec92dec7a

  • SHA512

    7b703f1006f0a67184e95072eb14f5c24161e45ad134e690fc4b25640798e6ecd966d14c736f5782e5efd4d604a34bc89805257250cd80ba9bae30715df9e159

  • SSDEEP

    98304:xnsmtk2aPV6s5YTnGUIcNAYDtYsvs6zqVXoQW07XlOVZ+dHXn8RXHhxBh7ZM5DBW:NLiV6s5XUxNAotvsjoQhLGQHuXrEBW

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • VMProtect packed file 10 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winer\Winner_Free.exe
    "C:\Users\Admin\AppData\Local\Temp\winer\Winner_Free.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Users\Admin\AppData\Local\Temp\winer\._cache_Winner_Free.exe
      "C:\Users\Admin\AppData\Local\Temp\winer\._cache_Winner_Free.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:2836
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Users\Admin\AppData\Local\Temp\winer\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\winer\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2272
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c title H26ma78D5Ibqmm5gPhzC8LNUGOiNDAVh50aVwCwO9m88t0QBWBp2Hwykqbe0
          4⤵
            PID:2896
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
      1⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:812

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Synaptics\Synaptics.exe

      Filesize

      6.3MB

      MD5

      babd90df8276efdedb7a0510d6d6e8aa

      SHA1

      9a43619fea06385a32a8bda7f125c834b7824f0a

      SHA256

      925840c7fa54b3bd5f8df5ed843d6872e30c95b423b10dedf6c6f56ec92dec7a

      SHA512

      7b703f1006f0a67184e95072eb14f5c24161e45ad134e690fc4b25640798e6ecd966d14c736f5782e5efd4d604a34bc89805257250cd80ba9bae30715df9e159

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      654ba506d19532281ed49827d9a59567

      SHA1

      7d79055bd1f92995b33defb4626f1d03e3950de0

      SHA256

      0ea22599d5bf2616a4a03f368c4a473fb21d5e5fc19ae20ca06b5d2130f427f8

      SHA512

      2b6fefb4de2b92109f4be0231db24d9a7498d16854f98d0701bbd01d19fec49d374b06b146bd8e39051aca17d6aacee0087abfa134980d0d5ac43b0e99ffa206

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      2670a409b8d3765055540d8b386b86a2

      SHA1

      7b6f523c40a3cbda908b1d35339c10168380790f

      SHA256

      a97faaf0064f53a18da0c4ffbe6f635edf53e18ae79313f53670d66665650c43

      SHA512

      76be7b02091538e16833433892d29bb7cc5be742894a3bdd1361ae4fa435ec05d16d5047a9085c2bcb82c543517ea46f7b95be9af866d780d2fba53bf7db95f5

    • C:\Users\Admin\AppData\Local\Temp\CabF52A.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\LRUcJu9w.xlsm

      Filesize

      17KB

      MD5

      e566fc53051035e1e6fd0ed1823de0f9

      SHA1

      00bc96c48b98676ecd67e81a6f1d7754e4156044

      SHA256

      8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

      SHA512

      a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

    • C:\Users\Admin\AppData\Local\Temp\Tar1AB.tmp

      Filesize

      51KB

      MD5

      2254a8817447a7f0bf02f298a79fd36c

      SHA1

      1379d3eb04e8f74c6a1d679608da666121ee4dde

      SHA256

      0818efb1c016c0176194a0c842d847cc92e996dbcca70faee72da472d2981e9f

      SHA512

      e312b6409b2be41d581104c07d5336f11f962721c4acea06d1d3e4fd1803270a8e16f0999bbbcf6a387cac36db63e82015bbd883a58fc68601283ce6f52e76d9

    • C:\Users\Admin\AppData\Local\Temp\winer\._cache_Synaptics.exe

      Filesize

      5.4MB

      MD5

      d0810b8a7f2706cd9a27ac5873c97164

      SHA1

      0b898adfc486150f1159f7f3fdda9864417dd7f8

      SHA256

      3496385d310281c920fad86d314e8b2e10186e9e9b91a9f49aaaefa66b8bc6a7

      SHA512

      cd08d317aff0330fab915c51f53404afc6a567cb6e7a919530697f2c7dda2ef58711209557a67742c6c0f0c1a8e503d3c111045a82b47ff3411a333f282fad76

    • C:\Users\Admin\AppData\Local\Temp\winer\._cache_Winner_Free.exe

      Filesize

      4.9MB

      MD5

      01765ce4b55fe4ba48a627303ffaf90d

      SHA1

      349f746f072ce4d6a201c2018a553b531fd398fa

      SHA256

      5f3d86558293138ce921c4cfc924409753c49f850becabe1e09da9a2ac90dc0d

      SHA512

      767c5da70765dca0f162c312799256995c3247f4f9f81f3b713bf371cc8f0dd9e59ffab763dbf31d72f0dff505ac86d773d6287a7e8ef1cb68398cde789c4c75

    • C:\Users\Admin\AppData\Local\Temp\winer\._cache_Winner_Free.exe

      Filesize

      5.6MB

      MD5

      a8133b3fdf3ec104c0f0d503ef6a7ec7

      SHA1

      d875876bd027a59b9157a45df00a24ccd505ed20

      SHA256

      c3429972cc6d611fa4f940f89624658e3aadc85a681bdcd5adce9bdc6c6d3072

      SHA512

      2734304de246490ff8d3ab0487838afc6cc2abb7cfbc0404860cbb395ba69887c33b802a08d32f8ccd2c6e341e4b5062c3aa27b3de2f4bba3c542d984e4721b1

    • \Users\Admin\AppData\Local\Temp\winer\._cache_Winner_Free.exe

      Filesize

      4.3MB

      MD5

      9025127df46fc9db964fd875ff9c99d9

      SHA1

      526bd39f6859460a649271ae7ecf59e97cc541ea

      SHA256

      49eed8f58de6356bb42e32861c0ad6e9b4728080860aac11dedcbfa43e4edfbe

      SHA512

      1db85a65bfc2dae5bce068b5b2a4e0343a4200148de25bf68192cd166b3c6e47b70ba4940c5bb0893b96711d00addfffdc2a8e97a21edd1575f247cdbed3a801

    • memory/812-174-0x000000007262D000-0x0000000072638000-memory.dmp

      Filesize

      44KB

    • memory/812-71-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/812-72-0x000000007262D000-0x0000000072638000-memory.dmp

      Filesize

      44KB

    • memory/2272-65-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2272-112-0x0000000000EC0000-0x00000000017C1000-memory.dmp

      Filesize

      9.0MB

    • memory/2272-172-0x0000000000EC0000-0x00000000017C1000-memory.dmp

      Filesize

      9.0MB

    • memory/2272-54-0x0000000000100000-0x0000000000101000-memory.dmp

      Filesize

      4KB

    • memory/2272-42-0x0000000000EC0000-0x00000000017C1000-memory.dmp

      Filesize

      9.0MB

    • memory/2272-60-0x00000000777D0000-0x00000000777D1000-memory.dmp

      Filesize

      4KB

    • memory/2272-46-0x0000000000EC0000-0x00000000017C1000-memory.dmp

      Filesize

      9.0MB

    • memory/2272-47-0x0000000000100000-0x0000000000101000-memory.dmp

      Filesize

      4KB

    • memory/2272-55-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2272-61-0x0000000000110000-0x0000000000111000-memory.dmp

      Filesize

      4KB

    • memory/2560-111-0x0000000000400000-0x0000000000A51000-memory.dmp

      Filesize

      6.3MB

    • memory/2560-204-0x0000000000400000-0x0000000000A51000-memory.dmp

      Filesize

      6.3MB

    • memory/2560-190-0x0000000000400000-0x0000000000A51000-memory.dmp

      Filesize

      6.3MB

    • memory/2560-173-0x0000000000400000-0x0000000000A51000-memory.dmp

      Filesize

      6.3MB

    • memory/2560-27-0x00000000002B0000-0x00000000002B1000-memory.dmp

      Filesize

      4KB

    • memory/2560-73-0x0000000000400000-0x0000000000A51000-memory.dmp

      Filesize

      6.3MB

    • memory/2560-33-0x0000000000400000-0x0000000000A51000-memory.dmp

      Filesize

      6.3MB

    • memory/2836-57-0x00000000777D0000-0x00000000777D1000-memory.dmp

      Filesize

      4KB

    • memory/2836-40-0x0000000000E70000-0x0000000001771000-memory.dmp

      Filesize

      9.0MB

    • memory/2836-48-0x0000000000190000-0x0000000000191000-memory.dmp

      Filesize

      4KB

    • memory/2836-41-0x0000000000190000-0x0000000000191000-memory.dmp

      Filesize

      4KB

    • memory/2836-66-0x00000000001A0000-0x00000000001A1000-memory.dmp

      Filesize

      4KB

    • memory/2836-51-0x0000000000E70000-0x0000000001771000-memory.dmp

      Filesize

      9.0MB

    • memory/2836-62-0x00000000001A0000-0x00000000001A1000-memory.dmp

      Filesize

      4KB

    • memory/2836-53-0x0000000000190000-0x0000000000191000-memory.dmp

      Filesize

      4KB

    • memory/2880-26-0x0000000000400000-0x0000000000A51000-memory.dmp

      Filesize

      6.3MB

    • memory/2880-18-0x0000000000400000-0x0000000000A51000-memory.dmp

      Filesize

      6.3MB

    • memory/2880-0-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB