Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    61s
  • max time network
    25s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2024, 05:01

General

  • Target

    42d222cfe08a8e609a71630308920e58.exe

  • Size

    194KB

  • MD5

    42d222cfe08a8e609a71630308920e58

  • SHA1

    764114e089c49036c692a898fbffa02a6b911e8a

  • SHA256

    ddb4a02eb9092efaf14750423a5d1c2b76e34c586ef6499891e1d1875770ce08

  • SHA512

    32c2b6da0d26b1efd534b1b6492854dd44da339d1b27d2604b9f7f1d3c5c519cc3bd8b7d1ee33daa96816e073e8fca613dfcd80a577e10262a8df051bd562a60

  • SSDEEP

    3072:hn1/uEAgDPdkBlyFZ+ScjaiKWbETBquAEXlqsUUTzwQRvEZ9yu:h1OgDPdkBAFZWjadD4s5TzHELP

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42d222cfe08a8e609a71630308920e58.exe
    "C:\Users\Admin\AppData\Local\Temp\42d222cfe08a8e609a71630308920e58.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\50fb742d02760.exe
      .\50fb742d02760.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      PID:1928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Zoomex\uninstall.exe

    Filesize

    48KB

    MD5

    f3c79bda3fdf7c5dd24d60400a57cadb

    SHA1

    1adb606aaeedb246a371c8877c737f0f8c798625

    SHA256

    a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

    SHA512

    c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    41a7ed649138e701d9a20f43c277a09f

    SHA1

    3943bbe2aecdf86030ea8332f7d9b296f064165f

    SHA256

    e00037272acfa824ef1f11c7d79ebe39bd630fa39a71fe7557efd3b0cbdef981

    SHA512

    a3d54680cb6e9ef766bc4833d81809a1e15522a0c8010c7d28e8cba6a437ba6d1457f8bc8b00617a533a84a2fe33046e1af9f415c8e1200e8e0f7a811c6a85aa

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\[email protected]\chrome.manifest

    Filesize

    116B

    MD5

    fcbdd0b465f36525eb9e3935cf4d68d2

    SHA1

    171d4c0b7560063efaebcdb6de862651a397ee60

    SHA256

    bfa3999b6dadd0f34be2e58b00497e631c3689a428b27f65f6938282d7d756ce

    SHA512

    68bf6e66a4adcb709d8c85d761cac96b0f6aa9270453035edf119b93d56d2afd245e0a047053289cc6e38e669b12553a52a4f398859953db1ce19104e888ee43

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\[email protected]\content\bg.js

    Filesize

    8KB

    MD5

    0f2794c17af3462ce560f62afd777227

    SHA1

    c5156569f57273d0c1f9da7a2159832107f09aff

    SHA256

    1de305313d4d482282b89bb2af616edce5d6291d1afeb853975c04b53479739b

    SHA512

    a584575553960c1e9e5a935b9f9ffb0b009f83cc9ed7aaad0d54f8d378de93791ce57f81540182738a0eaf0a6b6057f4d73f910dccae92d024c3529392528132

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\[email protected]\content\zy.xul

    Filesize

    225B

    MD5

    674b9c82c62c5c116a9cd3f651622630

    SHA1

    9adeb8944fcf093f46a1bb6601e69c9fda417e09

    SHA256

    aa9e1c5371772e44b3dd6b6e75be265701b3673f4a8662847dd0a41a694aa7bd

    SHA512

    790bc3ab359a266893a8a33b1c3b1dbe1025ba8cf45b40b60c37b69e708817c119b0125e75041636075e3b951da60db16ef9e79609aeb60375c1261505f194c6

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\[email protected]\install.rdf

    Filesize

    700B

    MD5

    374ab42378df1fe57c1f537dadb240a9

    SHA1

    31bf848901cac98e2fb0f729e84f901c63403f44

    SHA256

    35e656f0eca83eceda5286ce9c9fb5370431fb63154abbc74b6221474524fc1a

    SHA512

    2792fdb54da9f6ecc3ed994d945a2109bb586f35affb9d5bbce40ba928830dd4ee0eaf0420ce789923bf53302047fd0f5a7e540af6d29b05d76d1ed763329973

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\jepfhbjdcfdmjkijookhihmpcgmcamlm\50fb742d0256e7.82991795.js

    Filesize

    4KB

    MD5

    9b89a6c5d719efcebf857d38f518f561

    SHA1

    18bdf5683528666a9febd8ca0944beaf937968a7

    SHA256

    25bf4260b90151f4508f4c5a7a5bc65ad0469976aef04143e83a2b0ab0b0de3f

    SHA512

    f78313b02cafdd2b09d89f99b8c1ef634f1e1f202ba4b59a68ecb9084c6923371750370852565e90eefc4359b7558f062c49397ee337f5d753472d6ca77d386b

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\jepfhbjdcfdmjkijookhihmpcgmcamlm\background.html

    Filesize

    161B

    MD5

    c07d19093a178bfef21e49e492e8c9eb

    SHA1

    37c10130497c8d4cb7e2832845e5092d2a13917d

    SHA256

    1deec4afb6b62f36b5250c4d56a3e24b10f96a5d53d0b4b9388ae7343fdede9c

    SHA512

    cf1e472ff72cb917de69db92f5d3e1c0d9bd484589ac7d67052350095d4a0f167f7698466caca12a592b61543f4cec9bc0a31cbae8a095e3c748551478a6a51c

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\jepfhbjdcfdmjkijookhihmpcgmcamlm\content.js

    Filesize

    197B

    MD5

    5f9891607f65f433b0690bae7088b2c1

    SHA1

    b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

    SHA256

    fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

    SHA512

    76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\jepfhbjdcfdmjkijookhihmpcgmcamlm\lsdb.js

    Filesize

    559B

    MD5

    209b7ae0b6d8c3f9687c979d03b08089

    SHA1

    6449f8bff917115eef4e7488fae61942a869200f

    SHA256

    e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

    SHA512

    1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\jepfhbjdcfdmjkijookhihmpcgmcamlm\manifest.json

    Filesize

    475B

    MD5

    95b6b9aa3a3730d6d373a68eb5b411c9

    SHA1

    05cc71bfa2d2a2a18e169def790cca29f757dd3e

    SHA256

    5ac43caaa60d48d2c5bc8059dc845eb344b31c088207c8da714f7a36d500c69e

    SHA512

    5a178056071d0c94d2cfdf72a60403fbf9703cc28abe560f1f04fc2e073188f595c6bb3b687c7e2654899e103a229fe123c41af8aebbe189c9854ed71d8c672e

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\jepfhbjdcfdmjkijookhihmpcgmcamlm\sqlite.js

    Filesize

    1KB

    MD5

    0cd60262c81ea56fa5664591f42e6681

    SHA1

    7575c25332bc89e9247d090a9b9b27e01b9f74cc

    SHA256

    de3024fa783106dc7be968245370eea22931c87d5330841ce83f367114d459ed

    SHA512

    5e3c81df569f033dd4e3ac462dee5b2e66a14988490171b63cad45a4c2193b02c5c874d34048d7149e36997803c8e9e765832c322c462810d681ebfb63f849dc

  • C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\settings.ini

    Filesize

    882B

    MD5

    c468db40505cd2d006b223aba84f1a20

    SHA1

    69795b63a8ea1cbb9b6c5d467afa870ea9a12386

    SHA256

    791dd1858890532430a37310dfd8eff0397e78b3d38bc77707c0913e9119b516

    SHA512

    4ac84112a9f31b39d9c4ccbeb814399dd3d82231827ceec1204e050b4c22d0ee8283331f58a0d446a922acdff180d856c02009e02b4a71747e3879cf92116aeb

  • \Users\Admin\AppData\Local\Temp\7zS622D.tmp\50fb742d02760.exe

    Filesize

    71KB

    MD5

    b78633fae8aaf5f7e99e9c736f44f9c5

    SHA1

    26fc60e29c459891ac0909470ac6c61a1eca1544

    SHA256

    d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

    SHA512

    3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

  • \Users\Admin\AppData\Local\Temp\nsj8CC6.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    7579ade7ae1747a31960a228ce02e666

    SHA1

    8ec8571a296737e819dcf86353a43fcf8ec63351

    SHA256

    564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    SHA512

    a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

  • \Users\Admin\AppData\Local\Temp\nsj8CC6.tmp\nsJSON.dll

    Filesize

    7KB

    MD5

    b9cd1b0fd3af89892348e5cc3108dce7

    SHA1

    f7bc59bf631303facfc970c0da67a73568e1dca6

    SHA256

    49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

    SHA512

    fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

  • memory/1928-77-0x0000000074600000-0x000000007460A000-memory.dmp

    Filesize

    40KB