Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

16/01/2024, 20:48

240116-zlfnwabcc6 3

16/01/2024, 20:42

240116-zhex6sadbp 10

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    16/01/2024, 20:42

General

  • Target

    setup_installer.exe

  • Size

    1.5MB

  • MD5

    20422726c8e4927d713498906dd09125

  • SHA1

    6ad68482e1e8ed16baff9426d043e36523a26cf5

  • SHA256

    2d249a1e253b6f4cdb33c2d45345ab2ca3af23b45b1e3545ede10ed68e7b9bdb

  • SHA512

    e6b4a3d8ba926b4747210ff85b9961ba87f68eac07a7c9e987cec819f694a9bbbb4df47c1a10c8dce4134c6affd1da57ec02feaf2816396078c6f070b65d3b5c

  • SSDEEP

    24576:xcVkKSZXCeomdCFDWHp/7F82sLDEPY/RQ5DsvLwcaBhdZIl9mT9OHDpFoaGBc6X:xcBaCpZgu2+DEwJ84vLRaBtIl9mTYjje

Malware Config

Extracted

Family

nullmixer

C2

http://marisana.xyz/

Extracted

Family

smokeloader

Botnet

pub6

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 23 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Users\Admin\AppData\Local\Temp\7zSC68C3326\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSC68C3326\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c karotima_2.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Users\Admin\AppData\Local\Temp\7zSC68C3326\karotima_2.exe
          karotima_2.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:2556
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c karotima_1.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2488
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 368
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2944
  • C:\Users\Admin\AppData\Local\Temp\7zSC68C3326\karotima_1.exe
    karotima_1.exe
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies system certificate store
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\7zSC68C3326\karotima_1.exe

    Filesize

    473KB

    MD5

    b8994038421f1e481cf47b0dc5521d65

    SHA1

    e00ae0ab14270670410f16bc2a3757bbb2416fab

    SHA256

    600d0d929de750cdce30edbb3170d0879681d9467a39edd5a461895775bd7b35

    SHA512

    4dd38cbcf9054e9f178fa3d1f66fe9b239de8011e2cc692385bdb87fa45b8290b45b47151ad7907f804a917a251e8b9e35740222be7a37e19784d2ddd8f124be

  • C:\Users\Admin\AppData\Local\Temp\7zSC68C3326\karotima_1.txt

    Filesize

    483KB

    MD5

    5f06e9d582b3f28d4f0cc35c84489d75

    SHA1

    1c346b99187af2cefa3c0bf352a0ff366cb55ea9

    SHA256

    3f97b042117cbe1c7d53137ea596d9e94f6bb92fe7e16aa9576c9bde52fb8617

    SHA512

    fc8eaf2843ed006874e09f9c1bf87bff920daa180c39ccf2141ab3a321eb487e010f4cf7df8295f3a3c06008d4809d3624cf62338370726ee07b88cdd48265db

  • C:\Users\Admin\AppData\Local\Temp\7zSC68C3326\libcurl.dll

    Filesize

    208KB

    MD5

    4fe826cb92065cbde8e8e5b0898c629c

    SHA1

    ae27142c3919aa47db0ee7db2c83e51e4d636047

    SHA256

    3b29a2b601a1b80d1905a0b9d52aff8ba6a5fd86ef2735baf3bc00a05684cadc

    SHA512

    9a08060d6b79a87f97a8fa51bf140bd9a385f27692816a4af1f7d7e9acf21f24a747c67977e2486e45ad40f8763a8e251d89c9f3fadff27d3edea7aa8d444528

  • C:\Users\Admin\AppData\Local\Temp\Tar1089.tmp

    Filesize

    52KB

    MD5

    4878942c54809e8d03f5b2992de8b0d4

    SHA1

    64b58f8d32a3d30200b1467d7c3234a4ca212918

    SHA256

    f54aab16b9cf10cc4f810d16320bc62e932a08c73cfae124d54b512300b9a5f2

    SHA512

    e0f5605a129b0d962c2df349020ff423f339fe1490b3c30bdfd9b4bec725b0a281c32f40e35f104a183bb488e37fc41fdc099644e2dda954ac972b925828cdf6

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\karotima_1.exe

    Filesize

    514KB

    MD5

    6674eed2a6f13aabfe3de7aa44d4af56

    SHA1

    34a0aef653a0a914bbb726c0324428b46d52d1d1

    SHA256

    4e95b58c2843475913e8ecd939f92d5b3690c04544e6d122d3332ed1c8bbcd35

    SHA512

    97108e18e229f5daa2236afe267caa02c8489c9da4a4fe11b10c9819f183891e23391b588bfc6b4f94e35fbd5c085ba7591d653eb3af866d9fe6b6659662d3fa

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\karotima_1.exe

    Filesize

    591KB

    MD5

    bc7dbdf78c9da3199fcf5ff4e6c74381

    SHA1

    af6e6c9010c04fa366d7af52d228ec1757b1b9a1

    SHA256

    aa59dd3b43ea762dddaf4a2ae3b80528232b3f044ad9b2277bb18ff3c322a7a3

    SHA512

    0d3cac8149f5a1d4c318b42223c9fb51bc4f5ccbf397d808c045c4827fdf890349be6374bc8a5e1342e90e9b7ce4a8b604265e98aea32fcee4f15b33f7ab73a9

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\karotima_1.exe

    Filesize

    439KB

    MD5

    2fcf7127c2d9f15c0a2ff7d5bb1bec8c

    SHA1

    53ea687441a99861d1c2638830ddb6d45b58d8bc

    SHA256

    4f2e43d0b947477a79adc2edf41b5fe70bef103d79c53242d195ad039dcbd454

    SHA512

    c08699aa441bd8443fb90e9eacac2edad2878ff015ecdecc3b8ab69d48467441a061ad2a748079c24749e737f3fb9cb2bf9973ecf5c0ec166103e1d1873d216b

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\karotima_2.exe

    Filesize

    238KB

    MD5

    fcd0f1b48eccb2fc312068010c8cb7d7

    SHA1

    3e0ac2b9c04d2238a37e3602e2b4d14d749b93d8

    SHA256

    8e9313037e41416a4d9af48b077cfa68457a5c716b164c6b40dfcd43b0775ea8

    SHA512

    e79e8b30567d391e02a7db111991903522cdeac3ab0216ae78d65be5294e79c6e9794fe2113976d0536c0dcecc05762d355edf3967d8c3682e4a0242b720af6b

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\libcurl.dll

    Filesize

    218KB

    MD5

    d09be1f47fd6b827c81a4812b4f7296f

    SHA1

    028ae3596c0790e6d7f9f2f3c8e9591527d267f7

    SHA256

    0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

    SHA512

    857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\libcurlpp.dll

    Filesize

    54KB

    MD5

    e6e578373c2e416289a8da55f1dc5e8e

    SHA1

    b601a229b66ec3d19c2369b36216c6f6eb1c063e

    SHA256

    43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

    SHA512

    9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\libgcc_s_dw2-1.dll

    Filesize

    113KB

    MD5

    9aec524b616618b0d3d00b27b6f51da1

    SHA1

    64264300801a353db324d11738ffed876550e1d3

    SHA256

    59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

    SHA512

    0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\libstdc++-6.dll

    Filesize

    647KB

    MD5

    5e279950775baae5fea04d2cc4526bcc

    SHA1

    8aef1e10031c3629512c43dd8b0b5d9060878453

    SHA256

    97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

    SHA512

    666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\libwinpthread-1.dll

    Filesize

    69KB

    MD5

    1e0d62c34ff2e649ebc5c372065732ee

    SHA1

    fcfaa36ba456159b26140a43e80fbd7e9d9af2de

    SHA256

    509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

    SHA512

    3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\setup_install.exe

    Filesize

    225KB

    MD5

    2389708f211fc2d6d10d739faf7c2d46

    SHA1

    4f5ff47cd813f08d7c224108a32a15d5cedb7ebd

    SHA256

    7034d0cff8100f101c4d6c38b60f9b90cc363f0e32cfad4d75e54da2b2bb6978

    SHA512

    3751cb3fdfee6bb7cd1e46dcbbdc9e9512b071c3cd3dc66b2b6f45b4aab45afd8779a27040cd78be7c30dbbc0f94415d95f56e51189bf7bb930d1dc101c1d807

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\setup_install.exe

    Filesize

    226KB

    MD5

    bdfd3042997d6aaf5e0b2aaeedac5d3f

    SHA1

    5877dfd0a6b1b0c2ea53bbaf853d6ad38f41b213

    SHA256

    7d78aace967e97f2b0e339ea93d2ffd9fc3e39d5c44d64cbf6257f365b8935d5

    SHA512

    8e70c597ca24ebcbe9eb42ae2fe1b35e249d93faa572721251268a0eeb0b710d8cc3a3e73c5e97be87befce049381fa33c1a5a29e300bbf0990a39a119334349

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\setup_install.exe

    Filesize

    121KB

    MD5

    0797a3c6727d01b7470b0f6d3b0dbdf4

    SHA1

    cb80797c7e4075399eb819f5feaee9eac10c66ab

    SHA256

    52a58e8a30186823ba8f5265612d5c192ac9e751377446715fe54cdb3a2797c0

    SHA512

    9ca0ba000c35f7e20cee997fc8153b7c63f1d02880974c5fb1f4cde6fcd06261227e8a96dcf493d3e11b417e4005d09297f6b42225da4db9cc0e6fdf7142c112

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\setup_install.exe

    Filesize

    287KB

    MD5

    3b51df78ffa71e3932aad06f0526e1db

    SHA1

    1d21bab4761467fcaaf12c8bb237cb679e0e704d

    SHA256

    5a773cc52816f6b01c91700e47aa9e7d1dd96875c29bb37493c5185658a05f61

    SHA512

    866cf8acc56c61e9acc44e9b4194e60d3f0813a02f46a292b06d0545dc87ec3c94bca7a82c3515a98ccc4753e6e7ffc3d3c9a69b62e5434ac79a73e3aade1525

  • \Users\Admin\AppData\Local\Temp\7zSC68C3326\setup_install.exe

    Filesize

    152KB

    MD5

    66426b0e25e3fac4959e993a3cee4a6a

    SHA1

    ae1c8397204eaf35fcede6b338699b91481d66a5

    SHA256

    2a5ed46e4022a2e803953c5ea4176940a100d55ac98fa46caa75a58d397e2d57

    SHA512

    5e37e8fd44e6f776191518bc3c2f6f4b6e2d78b6104f79148022ac9a7df126f4a7a4f0477beb6dcb4a1b7db57ec8fcb89aa6e1fea6039d477229a1b801b0fab7

  • \Users\Admin\AppData\Local\Temp\CC4F.tmp

    Filesize

    287KB

    MD5

    edc3835bd25750ca5240587ef3198227

    SHA1

    8a527ca40310444623942985c594a5eb40595dab

    SHA256

    f8023608fd22f114b04c3a206913875ed56cfb8eeb02beb70ab2afe7f89502d3

    SHA512

    05dfd14ea424e33e0c54945f8149cfa0257f982c30da026e1704ae2fa0b39faa3edbeee8176ec7f4df86f5f0edc7ae43bc3958501ba72057db3908aa8f833cd4

  • memory/1328-125-0x0000000003C40000-0x0000000003C55000-memory.dmp

    Filesize

    84KB

  • memory/2068-53-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2068-58-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2068-56-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2068-55-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2068-59-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2068-62-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2068-63-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2068-64-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2068-66-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2068-65-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2068-54-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2068-51-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2068-48-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2068-47-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2068-46-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2068-60-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2068-130-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/2068-57-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2068-131-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2068-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2068-49-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/2068-38-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2068-35-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2068-29-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2068-133-0x000000006EB40000-0x000000006EB63000-memory.dmp

    Filesize

    140KB

  • memory/2068-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2068-129-0x0000000000400000-0x000000000051E000-memory.dmp

    Filesize

    1.1MB

  • memory/2156-27-0x0000000003150000-0x000000000326E000-memory.dmp

    Filesize

    1.1MB

  • memory/2156-20-0x0000000003150000-0x000000000326E000-memory.dmp

    Filesize

    1.1MB

  • memory/2556-126-0x0000000000400000-0x00000000008A5000-memory.dmp

    Filesize

    4.6MB

  • memory/2556-80-0x0000000000CF0000-0x0000000000DF0000-memory.dmp

    Filesize

    1024KB

  • memory/2556-81-0x0000000000250000-0x0000000000259000-memory.dmp

    Filesize

    36KB

  • memory/2556-84-0x0000000000400000-0x00000000008A5000-memory.dmp

    Filesize

    4.6MB