Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2024, 12:41

General

  • Target

    5b439f0679891477a6720337b94d12e8.exe

  • Size

    736KB

  • MD5

    5b439f0679891477a6720337b94d12e8

  • SHA1

    237f2259e8be726cdee3343ac0a5f4fa557c98dc

  • SHA256

    ead7dacfbe3fe40959353445ca3a754e9254c993d6a0efc7d99f960b01156df6

  • SHA512

    6bbe59f30d93972bb2e753364fe9ed2af6942c8b66430ecf111368a89cf952ea97ae2f5df009c4d5afbb8ae139bf0befc33c3a3267a55f573f95d1bd9723ab9c

  • SSDEEP

    12288:gpQFKc84EnyLz1emmZ+kEOc4dYchfL7pNWZQZrJe2WhmbT:gpQAcnLzY7EP6PhfLziQMhhmbT

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b439f0679891477a6720337b94d12e8.exe
    "C:\Users\Admin\AppData\Local\Temp\5b439f0679891477a6720337b94d12e8.exe"
    1⤵
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun84.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Users\Admin\Desktop\Internet Explorer.lnk" /G Everyone:R /C
        3⤵
          PID:3012
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
            PID:872
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun1.bat" "
          2⤵
            PID:1396
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
                PID:1140
              • C:\Windows\SysWOW64\cacls.exe
                cacls "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\╞⌠╢» Internet Explorer Σ»└└╞≈.lnk" /G Everyone:R /C
                3⤵
                  PID:2076
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun0.bat" "
                2⤵
                  PID:2192
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun79.bat" "
                  2⤵
                    PID:1296
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun84.bat" "
                    2⤵
                      PID:1608
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun97.bat" "
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2372
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun36.bat" "
                      2⤵
                        PID:2604
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun53.bat" "
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2816
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun49.bat" "
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1664
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      1⤵
                        PID:1816
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        1⤵
                          PID:360
                        • C:\Windows\SysWOW64\cacls.exe
                          cacls "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\Launch Internet Explorer Browser.lnk" /G Everyone:R /C
                          1⤵
                            PID:1236
                          • C:\Windows\SysWOW64\cacls.exe
                            cacls "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\Launch Internet Explorer Browser.lnk" /G Everyone:R /C
                            1⤵
                              PID:1780
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                              1⤵
                                PID:1000
                              • C:\Windows\SysWOW64\cacls.exe
                                cacls "C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe" /G Everyone:R /C
                                1⤵
                                  PID:1896
                                • C:\Windows\SysWOW64\cacls.exe
                                  cacls "C:\Users\Admin\Desktop\Internet Explorer.lnk" /G Everyone:R /C
                                  1⤵
                                    PID:1584
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                    1⤵
                                      PID:2644
                                    • C:\Windows\SysWOW64\cacls.exe
                                      cacls "C:\Users\Admin\Desktop\Internet Explorer.lnk" /G Everyone:R /C
                                      1⤵
                                        PID:2212
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                        1⤵
                                          PID:2468
                                        • C:\Windows\SysWOW64\cacls.exe
                                          cacls "C:\Users\Admin\Desktop\Internet Explorer.lnk" /G Everyone:R /C
                                          1⤵
                                            PID:3020
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                            1⤵
                                              PID:2880

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Program Files (x86)\Internet Explorer\ie\iexplore.exe

                                              Filesize

                                              787KB

                                              MD5

                                              c8a8321292a459b0a17fb39a782a5c74

                                              SHA1

                                              ef08e68af5b52c468a905a016ddbfb7c5b0a62e6

                                              SHA256

                                              a214e3b654bcb6e6142e101b0e89081d44a3a634afa94dc0a620467335b7beb2

                                              SHA512

                                              e43131e59ad638445d041753b3711a261134b7a557c10a462ed26c8db72c90814e561013b8b57fc64be5f9339eba875e14f48af54f0218735e6733227c264553

                                            • C:\Users\Admin\AppData\Local\Temp\srun0.bat

                                              Filesize

                                              194B

                                              MD5

                                              f0c2a210ecb2bf2a1a14d1d98f7bc73e

                                              SHA1

                                              092eacb2c5229ab369aa363ed226916cb8147d6a

                                              SHA256

                                              8c59675d500769cda44f795478d9446b588342c2a805b6dc6ea65b9c35f1a5ff

                                              SHA512

                                              a37cb6eca536aeac7ad51865bbf6d26ed66a8b6f5b1f1f9945c18a0325d44fa7d0ff6603ca84a8687a5ff0ad67d48302d85795c2c5e8fcbbd1233f0d340bc999

                                            • C:\Users\Admin\AppData\Local\Temp\srun1.bat

                                              Filesize

                                              190B

                                              MD5

                                              11478752b7fcc1efc6605875545170f4

                                              SHA1

                                              61c770c0e26a3f0f4240228d4ee46fcc189a3d6f

                                              SHA256

                                              7b158ce8c19e9694600027e9e3747a28e73a41429f5f40d9959267a326d480a1

                                              SHA512

                                              3e4d735ec78ca9e76a57a88c531d510918ea7cc56623e989ff4301158ad54fac78b9827471bcef8960763f8cf6b5eb27236e7570c972cf70f171c08b985ad3ac

                                            • C:\Users\Admin\AppData\Local\Temp\srun36.bat

                                              Filesize

                                              142B

                                              MD5

                                              d9f6b38e963ab8ad0348afb8c575ee33

                                              SHA1

                                              2d1440713456e516e052502c02a01b973ace983b

                                              SHA256

                                              34883dca9747a92844a59bd3dd33dac7f26225f44b5df37380727eb09ed815d5

                                              SHA512

                                              c287c7d131a93bff1e197080dd478b17d2e94d2dbcd721b6fe6de5cac155307d59e813ba489f1cdd20b0607651bb6b8b38e0903a679b6a05d5ed49a35253f845

                                            • C:\Users\Admin\AppData\Local\Temp\srun49.bat

                                              Filesize

                                              130B

                                              MD5

                                              d47ca0b09132e2956ddad2989c4e2d94

                                              SHA1

                                              99e70f1cb597ba904b347e80179e2456cdd13dec

                                              SHA256

                                              5efc405042e9394ee2e19496627aef172eb26040b8b19afe4a8eed31f6127d96

                                              SHA512

                                              44af7392be5c8aa878b7c7ff5a1d93d945d361788d1b8fee9bb24b83e95a5c98bebd7ed78d52d5f7479cd5a087c523fda39751e21c742ca059f962dd47bda067

                                            • C:\Users\Admin\AppData\Local\Temp\srun53.bat

                                              Filesize

                                              130B

                                              MD5

                                              0a5d2a0e436c3c15a0b25f52dfd2141d

                                              SHA1

                                              2b21a960c5f4ab9d1d8961dc5e9e263f0045609f

                                              SHA256

                                              63f71dc305719914bd574bb683e0b9941746eaa0d02a98049662f8370f9fdb01

                                              SHA512

                                              7db898944465652c7331f190883769d18f86a4101a5a7aa1ed35ec9244a6e1ec1776be806b5863f47b8e90336ab809376703e5f52c3ad966b9ff4cb5f4740e64

                                            • C:\Users\Admin\AppData\Local\Temp\srun79.bat

                                              Filesize

                                              195B

                                              MD5

                                              f676b99f23de39c686cf273c3d229e2e

                                              SHA1

                                              4952992eaabf3057585d4ca512ed443a74bdbacd

                                              SHA256

                                              40da6398ea8d1556854ae0597d44b4175ffd0ae2e2fbba6f022591cd3b18ed0e

                                              SHA512

                                              bcfce852b5e2f31fc3bf72fd4985b00fa5d26c2d80b8e3e5a4687beef226b10860555507999f3c293c5ad219cab2555993e1e4821cb5dac1577d3dc9385ad271

                                            • C:\Users\Admin\AppData\Local\Temp\srun84.bat

                                              Filesize

                                              142B

                                              MD5

                                              f99689b4e512b242839e97f08547d1aa

                                              SHA1

                                              cc81f449cd948529d08341076add9e6e706962a3

                                              SHA256

                                              cd071c1a4b0db3c210341d50fb55c0f4858fb0454c94d5beb49426ea720e4d04

                                              SHA512

                                              9ff78647c498073216e4ec052720c42757fafef674d243c69194ddeed141d03adae36268067d698bd155d0fdbc6a1653b20ef4996dac808d5a6014dd0b00d3f6

                                            • C:\Users\Admin\AppData\Local\Temp\srun84.bat

                                              Filesize

                                              130B

                                              MD5

                                              91b38496ffc08eebe8f6350baa0d1e31

                                              SHA1

                                              486147992ca04e2ca4b92f7ed02670966f9dc25f

                                              SHA256

                                              26734d3ed69ff0948f281a6dd465f4ea33580d8ea21267065aa985a902b6f9da

                                              SHA512

                                              ea27650db59da61dc860f3615a59f770fbc736cc522d7c2d4a87a90946d51a93514c7bb949af6480a9e496836fa2a98d7491484b8afef0368aebdaf12117568f

                                            • C:\Users\Admin\AppData\Local\Temp\srun97.bat

                                              Filesize

                                              130B

                                              MD5

                                              dd3719e4acc0aa2ca9f7fb3de297db6b

                                              SHA1

                                              a85325dd66c156c17d48509aa672ede93639adba

                                              SHA256

                                              0aef401926e2a2ba2673bfcd11cac7201280d1519f70f44fb8c04cabc3436d65

                                              SHA512

                                              bd4ed5a3ba9e9192d28f4743733d6affb01b1db553806cd473d6bf2a780673c243da6440caac23e1623ae7a2fb2a4decd114691ebae9c39a23add9adbcfd48c4

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

                                              Filesize

                                              1KB

                                              MD5

                                              3c1420b21f4b5fe1473a63625b0cfbff

                                              SHA1

                                              24a8e67854767bdaca7bf72a09ba2a782a82bba2

                                              SHA256

                                              1443d2f7b88b2b41ad1bdfb83b27c4ba18f0dfa0fa5c676888333f571227a865

                                              SHA512

                                              b126e59b023808b61205b6ce1a92efb665d554fe5054ae83093d008febabf1ee38494caba3429fea0eb26148bba5a4e7b16f77f83e4c38e383960d47db1fc60a

                                            • C:\Users\Admin\Desktop\Internet Explorer.lnk

                                              Filesize

                                              1KB

                                              MD5

                                              220e45c1efe01aeef360fb019e70dfc5

                                              SHA1

                                              52d57df12dbb1466f0c65dfbbc72195c38651988

                                              SHA256

                                              6b7449489fcc42f0bc686b464bd20db7e9f631601623b3d6a517c751542cf19e

                                              SHA512

                                              fe72c496ecb1ec5f6d4652b593a06572f259f9d5b83cf267d6a0baf8b25ff4be7eea788ba024f15e382ad02243866a1e631bfb4012a76c187f89019fc943a8ed

                                            • memory/2916-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2916-95-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                              Filesize

                                              4KB