Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2024, 04:09

General

  • Target

    6c50c8abafb090571b809b7e440760fb.exe

  • Size

    318KB

  • MD5

    6c50c8abafb090571b809b7e440760fb

  • SHA1

    940400974cbe308babd859914b0f8158168a7d67

  • SHA256

    987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d

  • SHA512

    2e965287ef25056c6d9edd113ea87d72a674d90b01f9db97bf9092bb820bbd35cd8b125ba0593d73561f23f7916d3223322652a221258935d010ccd51f0f6878

  • SSDEEP

    6144:TKjZy6NQ1xaIN8kUedSzx2ME5+b/LNWZR6c2r4/OQfUg8UW:yNQ/2kb35+nsoc2MRF

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c50c8abafb090571b809b7e440760fb.exe
    "C:\Users\Admin\AppData\Local\Temp\6c50c8abafb090571b809b7e440760fb.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2616
      • C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe
        "C:\Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe
          "C:\Users\Admin\AppData\Local\Temp\System\nwtray.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1972
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
            C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

    Filesize

    70B

    MD5

    15ca2a60b35b747793a242b165d6611d

    SHA1

    c9ed4f2f5f3c69efb10ad2c154a649f29184d1af

    SHA256

    d85b4e442a01018b9d4968e7b4dd89e9bdb38c904e6d2e522c9d030fe74c6ae6

    SHA512

    3c16a29f0c8c34c8ad162e1ec191da8058f9eb41219442713fe7ffad589e576e9de7b004f22de82b6acd3edf15eb7825b69abd4aa64eec36453bb5a5bd209ed4

  • \Users\Admin\AppData\Local\Temp\System\nvxdsinc.exe

    Filesize

    39KB

    MD5

    38abcaec6ee62213f90b1717d830a1bb

    SHA1

    d8f5849d0d3f4ccc0dfb66a9a4a0442ac66a31b9

    SHA256

    6fee9a2c70b2cc48b0812f7cb2e09497c9c90941976f430a8f8279ad3c787768

    SHA512

    77eaabcbc6f7a3835b6220d72c4b1cae82d2125ea971907e33b15ceeede7e4da0741c6e63e988bd782ed6eb72ad3cbcba10ea83919eafd9b95d612c43a735274

  • \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

    Filesize

    318KB

    MD5

    6c50c8abafb090571b809b7e440760fb

    SHA1

    940400974cbe308babd859914b0f8158168a7d67

    SHA256

    987a459213fe3739f0b3a9599a965c98fd7ffe48217cb7051649767b5815a87d

    SHA512

    2e965287ef25056c6d9edd113ea87d72a674d90b01f9db97bf9092bb820bbd35cd8b125ba0593d73561f23f7916d3223322652a221258935d010ccd51f0f6878

  • memory/1972-53-0x0000000000B30000-0x0000000000B70000-memory.dmp

    Filesize

    256KB

  • memory/1972-80-0x0000000000B30000-0x0000000000B70000-memory.dmp

    Filesize

    256KB

  • memory/1972-59-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/1972-81-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/1972-83-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/1972-54-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/2584-79-0x0000000000470000-0x00000000004B0000-memory.dmp

    Filesize

    256KB

  • memory/2584-78-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/2584-44-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/2584-52-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/2584-47-0x0000000000470000-0x00000000004B0000-memory.dmp

    Filesize

    256KB

  • memory/2616-45-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-58-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-31-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-41-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-82-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-30-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2616-46-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-27-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-25-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-23-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-56-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-61-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2616-32-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2692-14-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/2692-75-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/2692-76-0x0000000000280000-0x00000000002C0000-memory.dmp

    Filesize

    256KB

  • memory/2692-77-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/2692-17-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/2692-16-0x0000000000280000-0x00000000002C0000-memory.dmp

    Filesize

    256KB

  • memory/2832-74-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/3044-15-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/3044-2-0x0000000000500000-0x0000000000540000-memory.dmp

    Filesize

    256KB

  • memory/3044-0-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB

  • memory/3044-1-0x0000000074D80000-0x000000007532B000-memory.dmp

    Filesize

    5.7MB