Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2024, 20:55

General

  • Target

    596474f912744f495ea4f95d4dc0c69e.exe

  • Size

    226KB

  • MD5

    596474f912744f495ea4f95d4dc0c69e

  • SHA1

    9ff10912ad2486d054286b6378d1c019be44678f

  • SHA256

    ae2db060b3c6276691230399307ece62d8b59d89f0d5c5d7ef2e03d60fdaeb00

  • SHA512

    b52dbe2777eb242a9755a1157c75f66782d5055376a60227083410970efef624f533677cec806a6d9b1848815fd67fbbf5615c7e213eff208e1ebcbf8772c351

  • SSDEEP

    3072:sA8AuJpiZ0hE0LFgEbGfVRTcnQ6pZVsO5XNnlQ1QHTjZfclIlYc3kH/TPPTOxny8:A9pM0BgVRB0ZVsALXEl32+LPPTOxn3j

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\596474f912744f495ea4f95d4dc0c69e.exe
    "C:\Users\Admin\AppData\Local\Temp\596474f912744f495ea4f95d4dc0c69e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Recycle.Bin\Recycle.Bin.exe
      "C:\Recycle.Bin\Recycle.Bin.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Users\Admin\AppData\Local\Temp\9Yo4D94.exe
        "C:\Users\Admin\AppData\Local\Temp\9Yo4D94.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recycle.Bin\config.bin

    Filesize

    35KB

    MD5

    a56a6141dffaf3c9fe845d941c3156b8

    SHA1

    4d7b611855f10d3b573bfd1e219268c4caca4763

    SHA256

    f11e24df3a2fde19f50134e7139f060dc26ac961db52ecc9ded33a4af6f87055

    SHA512

    ae7a41a478bab81ef4512e7edc064a454597c0e750d98c3ff7d9f59e27514fbfe86e1b28646fdfe70d8eaed747c566afc914ccb80b2526bfb5cdabefda6c6f8c

  • C:\Users\Admin\AppData\Local\Temp\9Yo4D94.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • \Recycle.Bin\Recycle.Bin.exe

    Filesize

    226KB

    MD5

    596474f912744f495ea4f95d4dc0c69e

    SHA1

    9ff10912ad2486d054286b6378d1c019be44678f

    SHA256

    ae2db060b3c6276691230399307ece62d8b59d89f0d5c5d7ef2e03d60fdaeb00

    SHA512

    b52dbe2777eb242a9755a1157c75f66782d5055376a60227083410970efef624f533677cec806a6d9b1848815fd67fbbf5615c7e213eff208e1ebcbf8772c351

  • memory/2404-36-0x00000000001C0000-0x00000000001C8000-memory.dmp

    Filesize

    32KB

  • memory/2404-38-0x00000000001C0000-0x00000000001C8000-memory.dmp

    Filesize

    32KB

  • memory/2404-34-0x00000000003B0000-0x00000000003F4000-memory.dmp

    Filesize

    272KB

  • memory/2404-33-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

  • memory/2404-22-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

  • memory/2404-20-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

  • memory/2852-86-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-57-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-171-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-170-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-169-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-168-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-167-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-32-0x00000000003B0000-0x00000000003F4000-memory.dmp

    Filesize

    272KB

  • memory/2852-166-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-165-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-163-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-43-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/2852-42-0x00000000003B0000-0x00000000003F4000-memory.dmp

    Filesize

    272KB

  • memory/2852-44-0x00000000003B0000-0x00000000003F4000-memory.dmp

    Filesize

    272KB

  • memory/2852-164-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-161-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-60-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-162-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-51-0x0000000000280000-0x0000000000285000-memory.dmp

    Filesize

    20KB

  • memory/2852-49-0x00000000003B0000-0x00000000003F4000-memory.dmp

    Filesize

    272KB

  • memory/2852-46-0x00000000003B0000-0x00000000003F4000-memory.dmp

    Filesize

    272KB

  • memory/2852-160-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-63-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-62-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-66-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-159-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-67-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-158-0x0000000002D70000-0x0000000002F34000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-64-0x0000000000D80000-0x0000000000F44000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-70-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-140-0x0000000075C50000-0x0000000075E14000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-139-0x0000000075C50000-0x0000000075E14000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-138-0x0000000075C50000-0x0000000075E14000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-137-0x0000000075C50000-0x0000000075E14000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-76-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-136-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-78-0x0000000077A61000-0x0000000077A63000-memory.dmp

    Filesize

    8KB

  • memory/2852-75-0x0000000077A5F000-0x0000000077A61000-memory.dmp

    Filesize

    8KB

  • memory/2852-80-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-81-0x0000000000D80000-0x0000000000F44000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-135-0x0000000075C50000-0x0000000075E14000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-134-0x0000000075F50000-0x0000000075F85000-memory.dmp

    Filesize

    212KB

  • memory/2852-84-0x0000000075780000-0x0000000075880000-memory.dmp

    Filesize

    1024KB

  • memory/2852-133-0x0000000075780000-0x0000000075880000-memory.dmp

    Filesize

    1024KB

  • memory/2852-87-0x0000000075C50000-0x0000000075E14000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-130-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-117-0x0000000000280000-0x0000000000285000-memory.dmp

    Filesize

    20KB

  • memory/2852-121-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-116-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-141-0x0000000075C50000-0x0000000075E14000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-115-0x0000000075C50000-0x0000000075E14000-memory.dmp

    Filesize

    1.8MB

  • memory/2852-114-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-113-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-111-0x00000000003B0000-0x00000000003F4000-memory.dmp

    Filesize

    272KB

  • memory/2852-110-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-109-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-106-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-100-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/2852-102-0x0000000075C50000-0x0000000075E14000-memory.dmp

    Filesize

    1.8MB

  • memory/3016-77-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-89-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-99-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-104-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-107-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-98-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-97-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-96-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-95-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-92-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-88-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-18-0x0000000002030000-0x00000000020E3000-memory.dmp

    Filesize

    716KB

  • memory/3016-90-0x0000000075780000-0x0000000075880000-memory.dmp

    Filesize

    1024KB

  • memory/3016-118-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-101-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-0-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

  • memory/3016-132-0x0000000075780000-0x0000000075880000-memory.dmp

    Filesize

    1024KB

  • memory/3016-85-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-103-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-79-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-91-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-83-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-73-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-72-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-71-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-74-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-65-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/3016-68-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/3016-1-0x0000000000220000-0x0000000000228000-memory.dmp

    Filesize

    32KB

  • memory/3016-94-0x000000000BAD0000-0x000000000BB14000-memory.dmp

    Filesize

    272KB

  • memory/3016-52-0x0000000000220000-0x0000000000228000-memory.dmp

    Filesize

    32KB

  • memory/3016-48-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

  • memory/3016-2-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

  • memory/3016-3-0x0000000001D60000-0x0000000001E70000-memory.dmp

    Filesize

    1.1MB

  • memory/3016-4-0x0000000001D60000-0x000000000202F000-memory.dmp

    Filesize

    2.8MB

  • memory/3016-5-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/3016-6-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/3016-7-0x0000000077A5F000-0x0000000077A61000-memory.dmp

    Filesize

    8KB

  • memory/3016-21-0x0000000002030000-0x00000000020E3000-memory.dmp

    Filesize

    716KB

  • memory/3016-9-0x00000000002B0000-0x00000000002B2000-memory.dmp

    Filesize

    8KB