Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 14:05

General

  • Target

    1aec1d350e84138d0cc80be3b3787028.dll

  • Size

    163KB

  • MD5

    1aec1d350e84138d0cc80be3b3787028

  • SHA1

    d72eb7f257aa71ad3d0e85a2738c24dce62def66

  • SHA256

    34bc9735615d1f0aa7d698d22a656ed621717dc8c8882a3286854f40f7e50f97

  • SHA512

    82898793dc9cd90dcab6e7a47875c6eaa87dd8cc2eceebfaa06ba5030e849928ab31c98ccb8ecbe99610d21d1d5513036f8f7796df92ce77cc29f102d2914b02

  • SSDEEP

    3072:/vdCWhm6xlKCp1sUQsCO76vHkJqcmjDIevxzbe9eKzRA1+0EEGaXVON:Xc+ggIvJp8D3EGaX

Score
8/10

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Modifies Internet Explorer Protected Mode 1 TTPs 15 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1aec1d350e84138d0cc80be3b3787028.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2336
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\1aec1d350e84138d0cc80be3b3787028.dll,#1
      2⤵
      • Modifies Internet Explorer Protected Mode
      • Modifies Internet Explorer Protected Mode Banner
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
          PID:1672
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe
          3⤵
          • Modifies Internet Explorer Protected Mode
          • Modifies Internet Explorer Protected Mode Banner
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          PID:2184
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe
          3⤵
          • Modifies Internet Explorer Protected Mode
          • Modifies Internet Explorer Protected Mode Banner
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          PID:2440
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1908
      • C:\Windows\system32\ctfmon.exe
        ctfmon.exe
        2⤵
        • Suspicious use of FindShellTrayWindow
        PID:2796
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2996

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      1125c5effe530cf9edabb63f1c8eda03

      SHA1

      e8dd4e17466f660bfe7f359210af54ad37507fa7

      SHA256

      2971f16368a459608c3e5dfbcd2cf16ed88187747650fd8f880f63f897566b87

      SHA512

      b6712371e9729b41bfaef33357425613d3d54b049d1d487b9cb70e55bf4dcc12a330913ab4485cca6cf4cd3c1e0814f9359fdb3432f86664c73c7919223d7aa1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e815bf29dd9acb4c40b8db35bbb69169

      SHA1

      d60ccee427cec88286baabcdac8b45318f45c411

      SHA256

      9f1dc8ee5750a2a5f50622c8f33625fcaa5b52f196c1c36ff73876a2f1757339

      SHA512

      c9af75ffcecea798ddad0fbf594db466d5f977d1bb3e4f13ab0a0cc0362bd7872ab1e61504daee23c82e5410d04b269a7746b759aff22fb944dd75990bb1c831

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      8e4a13cf5c1586216966c6a454bec7fb

      SHA1

      04078a8011f6bbe63a444377473a2dc39e963c44

      SHA256

      e625ce4dc26c2c4ea345d8e0cd063b5d59cef1be3c8752de36e4f82868f8f01a

      SHA512

      4d3a7f45f75b45dd1c1d76f8d2c9a042d84a05655bbfb34492a28840dc2478419389714d235aab9f99930d6bbc001428a52eea1c858837e902361c5472f9f0cb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      86284ed713939a234029fd01ede5618d

      SHA1

      da409cc20b8a4d8389727413844e8a1a576defec

      SHA256

      7e3bcb2797bf34cff75f5ed08a9bf1cde639912e7b86faecaa50c77d9923b97b

      SHA512

      ed074ed6c385af646baed2a18d329592c5d3bdf7558b3559b968a1add2f791b0d412a17aea65d1ae0707b6dfe9511a6ae6766f185068d430a1d0b075ce1f6c86

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f85824b8c319298cb854ec578385c8d9

      SHA1

      384a7f17795dc3d5875aa8f22c09c1ce87fe6be1

      SHA256

      472a4bd2ce6e28f86e2850f8662cd5291c916d84871ffed11e3f288a17f62046

      SHA512

      2722571f89d6053bfbeee314a1130736735115322172240bcd2443ca04fdf23610e2641ccb3a53dd08c3094fd7177074e70750cef2b5af839e34c9a304519f22

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      120e8ef415a30653cb5074621021f628

      SHA1

      5f50e7cafd1f2c1fe466bb9210533a4caf90fe11

      SHA256

      93f6d2062c88b84acd151acbb3b8ffb764cb116e2f90a10249482346a76fafc5

      SHA512

      d1cd3a6dad5fe3fc3de43473b8ad2c05a4be76f7a087e1ff4f69a15d96079152c207acfe2a11fd9d72e85164550a4bfae687020193e6f2f98547eab8fe464e9a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      9e065dd2157c4aa4fd7465de62865860

      SHA1

      d613b073dffa482a8585a64c690e4af507f165a8

      SHA256

      d9c745f933895ddf3d7506c1990c65382dc8544fa49fb8266c7c3a51cca8238c

      SHA512

      96cededf61ab0b07c23c48c9c8cf7574e123722c5873a2ff62742ad2ff8de301deb0d942ec4701138c59adf41b2e684df23890ef173e2b7ab8d4f4b69149d359

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      4165240d698b1bef61a184240cdf239e

      SHA1

      c6f73434c117f503380781273fabd7839c79b4f5

      SHA256

      1e670d9e73954993d7226288120551b643ddb66731d5797acdf4998f38ce3af1

      SHA512

      1fe925fcfab6a2b93806bee58ae99d4b2f883535ae6049c737b375fb85429782d90b0add3a148bbc13b1f13ea3f19b40967a7ab3da6d9b93bdbf571c7edc85f4

    • C:\Users\Admin\AppData\Local\Temp\Cab5F33.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar73FE.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • memory/1068-0-0x00000000001A0000-0x00000000001D0000-memory.dmp

      Filesize

      192KB

    • memory/1908-15-0x00000000037B0000-0x00000000037B1000-memory.dmp

      Filesize

      4KB

    • memory/1908-3-0x00000000037C0000-0x00000000037D0000-memory.dmp

      Filesize

      64KB

    • memory/1908-2-0x00000000037B0000-0x00000000037B1000-memory.dmp

      Filesize

      4KB

    • memory/2184-11-0x0000000000150000-0x0000000000180000-memory.dmp

      Filesize

      192KB

    • memory/2184-7-0x00000000001E0000-0x00000000001E2000-memory.dmp

      Filesize

      8KB

    • memory/2184-6-0x0000000000150000-0x0000000000180000-memory.dmp

      Filesize

      192KB

    • memory/2184-4-0x0000000000140000-0x0000000000141000-memory.dmp

      Filesize

      4KB

    • memory/2440-12-0x00000000001D0000-0x0000000000200000-memory.dmp

      Filesize

      192KB

    • memory/2440-10-0x00000000001D0000-0x0000000000200000-memory.dmp

      Filesize

      192KB