Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

16/01/2024, 20:48

240116-zlfnwabcc6 3

16/01/2024, 20:42

240116-zhex6sadbp 10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/01/2024, 20:42

General

  • Target

    setup_installer.exe

  • Size

    1.5MB

  • MD5

    20422726c8e4927d713498906dd09125

  • SHA1

    6ad68482e1e8ed16baff9426d043e36523a26cf5

  • SHA256

    2d249a1e253b6f4cdb33c2d45345ab2ca3af23b45b1e3545ede10ed68e7b9bdb

  • SHA512

    e6b4a3d8ba926b4747210ff85b9961ba87f68eac07a7c9e987cec819f694a9bbbb4df47c1a10c8dce4134c6affd1da57ec02feaf2816396078c6f070b65d3b5c

  • SSDEEP

    24576:xcVkKSZXCeomdCFDWHp/7F82sLDEPY/RQ5DsvLwcaBhdZIl9mT9OHDpFoaGBc6X:xcBaCpZgu2+DEwJ84vLRaBtIl9mTYjje

Malware Config

Extracted

Family

nullmixer

C2

http://marisana.xyz/

Extracted

Family

smokeloader

Botnet

pub6

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4576
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c karotima_2.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\karotima_2.exe
          karotima_2.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:3316
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c karotima_1.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1848
        • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\karotima_1.exe
          karotima_1.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          PID:4640
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 504
        3⤵
        • Program crash
        PID:4632
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4576 -ip 4576
    1⤵
      PID:4988

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\karotima_1.txt

      Filesize

      1.0MB

      MD5

      9108ad5775c76cccbb4eadf02de24f5d

      SHA1

      82996bc4f72b3234536d0b58630d5d26bcf904b0

      SHA256

      c9d5525b2f2b76087121039ee1c23ed35508e60f653479722ec64ea3a064878e

      SHA512

      19021a28555bba1fe1bdcdc8845f1bcadebd256c7db02b9329d6b44ae01a123a00e162cc34a97ba51f088cafa6f54ab1de8f82f771ac54b94a3a796f84f73362

    • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\karotima_2.txt

      Filesize

      238KB

      MD5

      fcd0f1b48eccb2fc312068010c8cb7d7

      SHA1

      3e0ac2b9c04d2238a37e3602e2b4d14d749b93d8

      SHA256

      8e9313037e41416a4d9af48b077cfa68457a5c716b164c6b40dfcd43b0775ea8

      SHA512

      e79e8b30567d391e02a7db111991903522cdeac3ab0216ae78d65be5294e79c6e9794fe2113976d0536c0dcecc05762d355edf3967d8c3682e4a0242b720af6b

    • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\libcurl.dll

      Filesize

      64KB

      MD5

      c34e60b74d70f21cb27cda6cba8db7f9

      SHA1

      9523d9f0dfbeece45b4ffb3145702877ce594a40

      SHA256

      f29e13cf41767cfd4c88d760b244f1ed2f361c4477f96eade8dfde40ffcc3208

      SHA512

      42ca98ac4431e05dbba789ca07b53694f3b002119f45bd3ebc119661b1de1f352d14eab468c0131ae4fe33ea0f1765f0c7afb50d04c134b8bc11f1a63697b82c

    • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\libcurl.dll

      Filesize

      218KB

      MD5

      d09be1f47fd6b827c81a4812b4f7296f

      SHA1

      028ae3596c0790e6d7f9f2f3c8e9591527d267f7

      SHA256

      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

      SHA512

      857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

    • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\libcurl.dll

      Filesize

      192KB

      MD5

      ea942ac06629d73c955d1d8bd8907f88

      SHA1

      8fc4268dc29bb1a4d72a3e32b69ccab2e5d3329e

      SHA256

      69b6845b1f7f5ce429924ecc68ad3c19a382eaeecae82c2bfe5b69f9c25150aa

      SHA512

      237ca18254a653356a0373a9b4b9339547ed30640ee9f21e80a681553815531a35409c50eaa2910573e809d47d2da2407227e68c3bfc93272e14307f2489bfad

    • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\libcurlpp.dll

      Filesize

      54KB

      MD5

      e6e578373c2e416289a8da55f1dc5e8e

      SHA1

      b601a229b66ec3d19c2369b36216c6f6eb1c063e

      SHA256

      43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

      SHA512

      9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

    • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\libgcc_s_dw2-1.dll

      Filesize

      113KB

      MD5

      9aec524b616618b0d3d00b27b6f51da1

      SHA1

      64264300801a353db324d11738ffed876550e1d3

      SHA256

      59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

      SHA512

      0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

    • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\libstdc++-6.dll

      Filesize

      647KB

      MD5

      5e279950775baae5fea04d2cc4526bcc

      SHA1

      8aef1e10031c3629512c43dd8b0b5d9060878453

      SHA256

      97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

      SHA512

      666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

    • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\libwinpthread-1.dll

      Filesize

      69KB

      MD5

      1e0d62c34ff2e649ebc5c372065732ee

      SHA1

      fcfaa36ba456159b26140a43e80fbd7e9d9af2de

      SHA256

      509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

      SHA512

      3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

    • C:\Users\Admin\AppData\Local\Temp\7zS8F3A5ED7\setup_install.exe

      Filesize

      287KB

      MD5

      3b51df78ffa71e3932aad06f0526e1db

      SHA1

      1d21bab4761467fcaaf12c8bb237cb679e0e704d

      SHA256

      5a773cc52816f6b01c91700e47aa9e7d1dd96875c29bb37493c5185658a05f61

      SHA512

      866cf8acc56c61e9acc44e9b4194e60d3f0813a02f46a292b06d0545dc87ec3c94bca7a82c3515a98ccc4753e6e7ffc3d3c9a69b62e5434ac79a73e3aade1525

    • C:\Users\Admin\AppData\Local\Temp\CC4F.tmp

      Filesize

      1.6MB

      MD5

      4f3387277ccbd6d1f21ac5c07fe4ca68

      SHA1

      e16506f662dc92023bf82def1d621497c8ab5890

      SHA256

      767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

      SHA512

      9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

    • memory/3316-75-0x0000000000400000-0x00000000008A5000-memory.dmp

      Filesize

      4.6MB

    • memory/3316-68-0x0000000000400000-0x00000000008A5000-memory.dmp

      Filesize

      4.6MB

    • memory/3316-67-0x00000000009C0000-0x00000000009C9000-memory.dmp

      Filesize

      36KB

    • memory/3316-66-0x0000000000B60000-0x0000000000C60000-memory.dmp

      Filesize

      1024KB

    • memory/3316-77-0x00000000009C0000-0x00000000009C9000-memory.dmp

      Filesize

      36KB

    • memory/3520-73-0x0000000002780000-0x0000000002795000-memory.dmp

      Filesize

      84KB

    • memory/4576-47-0x000000006B280000-0x000000006B2A6000-memory.dmp

      Filesize

      152KB

    • memory/4576-39-0x000000006B440000-0x000000006B4CF000-memory.dmp

      Filesize

      572KB

    • memory/4576-44-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

    • memory/4576-46-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

    • memory/4576-48-0x000000006B280000-0x000000006B2A6000-memory.dmp

      Filesize

      152KB

    • memory/4576-43-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

    • memory/4576-49-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

    • memory/4576-50-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

    • memory/4576-51-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

    • memory/4576-52-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

    • memory/4576-53-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

    • memory/4576-54-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

    • memory/4576-36-0x000000006B440000-0x000000006B4CF000-memory.dmp

      Filesize

      572KB

    • memory/4576-45-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

    • memory/4576-60-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

    • memory/4576-61-0x0000000064940000-0x0000000064959000-memory.dmp

      Filesize

      100KB

    • memory/4576-62-0x000000006B280000-0x000000006B2A6000-memory.dmp

      Filesize

      152KB

    • memory/4576-63-0x000000006B440000-0x000000006B4CF000-memory.dmp

      Filesize

      572KB

    • memory/4576-64-0x000000006EB40000-0x000000006EB63000-memory.dmp

      Filesize

      140KB

    • memory/4576-65-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

    • memory/4576-41-0x0000000064940000-0x0000000064959000-memory.dmp

      Filesize

      100KB

    • memory/4576-42-0x000000006B440000-0x000000006B4CF000-memory.dmp

      Filesize

      572KB

    • memory/4576-40-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

    • memory/4576-38-0x0000000000F00000-0x0000000000F8F000-memory.dmp

      Filesize

      572KB

    • memory/4576-37-0x000000006B440000-0x000000006B4CF000-memory.dmp

      Filesize

      572KB

    • memory/4576-29-0x000000006B280000-0x000000006B2A6000-memory.dmp

      Filesize

      152KB

    • memory/4576-22-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB