Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2024, 10:23

General

  • Target

    3cd4736e078626a00f2c36d6e5f09a1c.exe

  • Size

    556KB

  • MD5

    3cd4736e078626a00f2c36d6e5f09a1c

  • SHA1

    f7fddc294a13c78d12730dd1f4ee8c49055d1379

  • SHA256

    3a7be50f09bf3dd2a494aae3c79c938cfb70c77b348dab82737f8d783e49193a

  • SHA512

    e80e12af806220aed99a0dfa17d76ed35f05f174fe9e9b3ce5500fb80b0fa3379e507af133e644cf122397e1c83b76535d010ce7bfe005fb810dd66528e23e3e

  • SSDEEP

    12288:07Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:07L1yMgcnOds44Fp2PWUDI8

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 52 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    PID:336
  • C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe
    "C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Users\Admin\NB4wr66jY4.exe
      C:\Users\Admin\NB4wr66jY4.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Users\Admin\rieseu.exe
        "C:\Users\Admin\rieseu.exe"
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2796
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del NB4wr66jY4.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1896
    • C:\Users\Admin\2xek.exe
      C:\Users\Admin\2xek.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Users\Admin\2xek.exe
        "C:\Users\Admin\2xek.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:268
      • C:\Users\Admin\2xek.exe
        "C:\Users\Admin\2xek.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2276
      • C:\Users\Admin\2xek.exe
        "C:\Users\Admin\2xek.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2832
      • C:\Users\Admin\2xek.exe
        "C:\Users\Admin\2xek.exe"
        3⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • Suspicious behavior: EnumeratesProcesses
        PID:3068
      • C:\Users\Admin\2xek.exe
        "C:\Users\Admin\2xek.exe"
        3⤵
        • Executes dropped EXE
        PID:2824
    • C:\Users\Admin\3xek.exe
      C:\Users\Admin\3xek.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3040
      • C:\Users\Admin\AppData\Local\b72f5ba2\X
        *0*bc*7992224d*31.193.3.240:53
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:308
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
          PID:2464
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del 3cd4736e078626a00f2c36d6e5f09a1c.exe
        2⤵
        • Deletes itself
        PID:2088
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:428
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Modifies WinLogon for persistence
      PID:1244
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 100
      1⤵
      • Loads dropped DLL
      • Program crash
      PID:2308
    • C:\Windows\SysWOW64\tasklist.exe
      tasklist
      1⤵
      • Enumerates processes with tasklist
      • Suspicious use of AdjustPrivilegeToken
      PID:1148
    • C:\Windows\system32\wbem\WMIADAP.EXE
      wmiadap.exe /F /T /R
      1⤵
        PID:964
      • C:\Windows\system32\wbem\wmiprvse.exe
        C:\Windows\system32\wbem\wmiprvse.exe -Embedding
        1⤵
          PID:1892

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

          Filesize

          2KB

          MD5

          6d03845f1d43e10908336ba602894baa

          SHA1

          e804767710e4c25c01705ca8290cbfc8ebe0ca0c

          SHA256

          523ee58ceeed3abcbc59b51f745ebfdf3bff774dd9792e3be0f3aeb63e8ab324

          SHA512

          632a2b6aed9dd21e35db28f131cf1c384eb4c553f3bbe05874ddbe6fa5fa9cbe2548033d420b057cad6d9e93b171c6baa4382194c151164ceb0fb924be29aa2b

        • memory/268-100-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/268-102-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/268-101-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/268-97-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/268-85-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/268-107-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/268-91-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/268-89-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

        • memory/336-136-0x0000000001EF0000-0x0000000001EFB000-memory.dmp

          Filesize

          44KB

        • memory/336-133-0x0000000001EF0000-0x0000000001EFB000-memory.dmp

          Filesize

          44KB

        • memory/336-167-0x00000000029F0000-0x00000000029F2000-memory.dmp

          Filesize

          8KB

        • memory/1244-155-0x0000000002A30000-0x0000000002A3B000-memory.dmp

          Filesize

          44KB

        • memory/1244-127-0x0000000002A00000-0x0000000002A06000-memory.dmp

          Filesize

          24KB

        • memory/1244-128-0x00000000029F0000-0x00000000029F2000-memory.dmp

          Filesize

          8KB

        • memory/1244-123-0x0000000002A00000-0x0000000002A06000-memory.dmp

          Filesize

          24KB

        • memory/1244-119-0x0000000002A00000-0x0000000002A06000-memory.dmp

          Filesize

          24KB

        • memory/1244-143-0x0000000002A20000-0x0000000002A2B000-memory.dmp

          Filesize

          44KB

        • memory/1244-151-0x0000000002A00000-0x0000000002A08000-memory.dmp

          Filesize

          32KB

        • memory/2276-84-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB

        • memory/2276-88-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB

        • memory/2276-81-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB

        • memory/2276-86-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB

        • memory/2276-156-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB

        • memory/2276-69-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB

        • memory/2276-66-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB

        • memory/2276-71-0x0000000000400000-0x0000000000407000-memory.dmp

          Filesize

          28KB

        • memory/2340-60-0x00000000031A0000-0x0000000003C5A000-memory.dmp

          Filesize

          10.7MB

        • memory/2824-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2832-63-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

        • memory/2832-52-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

        • memory/2832-55-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

        • memory/2832-67-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

        • memory/2832-59-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

        • memory/3040-118-0x0000000000550000-0x0000000000650000-memory.dmp

          Filesize

          1024KB

        • memory/3040-161-0x0000000030670000-0x00000000306C7000-memory.dmp

          Filesize

          348KB

        • memory/3040-169-0x0000000030670000-0x00000000306C7000-memory.dmp

          Filesize

          348KB

        • memory/3040-162-0x0000000000550000-0x0000000000650000-memory.dmp

          Filesize

          1024KB

        • memory/3040-117-0x0000000030670000-0x00000000306C7000-memory.dmp

          Filesize

          348KB

        • memory/3068-54-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB

        • memory/3068-57-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB

        • memory/3068-58-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB

        • memory/3068-149-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB

        • memory/3068-41-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB

        • memory/3068-43-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB

        • memory/3068-45-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB

        • memory/3068-49-0x0000000000400000-0x0000000000429000-memory.dmp

          Filesize

          164KB