Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2024, 21:53

General

  • Target

    7e19b2b97cc2e5de685917189f391499.exe

  • Size

    762KB

  • MD5

    7e19b2b97cc2e5de685917189f391499

  • SHA1

    11f7d260108b230ac1a73515b97951a3bb5eb22e

  • SHA256

    8471b910ca27f0ca1408d5fbea466040c85de6963e99b97b496a937f241cdf23

  • SHA512

    008b982f336a8151ee0be01d1ce3bbb9ffa79a434d76d16750a897f3b8184e4ff204b8ef5da5794eb11b464a7cfbd98879ce7df36f7fce527b0b3538826f4ebd

  • SSDEEP

    12288:ntobirltpeTtNXmLFhppAEDlPRCdc5XY/ouP9Tk284UhzSX65rdAmawrm29fPTnu:ntDltItNW7pjDlpt5XY/2TkXKza/29y

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e19b2b97cc2e5de685917189f391499.exe
    "C:\Users\Admin\AppData\Local\Temp\7e19b2b97cc2e5de685917189f391499.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Users\Admin\AppData\Local\Temp\nst3E2B.tmp\internal7e19b2b97cc2e5de685917189f391499.exe
      C:\Users\Admin\AppData\Local\Temp\nst3E2B.tmp\internal7e19b2b97cc2e5de685917189f391499.exe C:/Users/Admin/AppData/Local/Temp/nst3E2B.tmp /baseInstaller='C:/Users/Admin/AppData/Local/Temp/7e19b2b97cc2e5de685917189f391499.exe' /fallbackfolder='C:/Users/Admin/AppData/Local/Temp/nst3E2B.tmp/fallbackfiles/'
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\32068.bat" "C:\Users\Admin\AppData\Local\Temp\01CCAE26F1C846128DAC9339E36CC4BA\""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\PING.EXE
          ping 1.1.1.1 -n 1 -w 1000
          4⤵
          • Runs ping.exe
          PID:872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-928733405-3780110381-2966456290-1000\$I92J529

    Filesize

    544B

    MD5

    0e62bad15e351cd866da63475695a9ca

    SHA1

    13fbd066316cbafdcdfe56d01bc414a1a02e6884

    SHA256

    408e598c067670a5e293564899969c84bef033d343524cc6b9bd38e56f03e03c

    SHA512

    a0c09a4f8b7b89525e0b2c70392918f8e11e4f830d4bdcce89da05a3d2fa0f4a9907c613d5aefd478ab3224e69d4b20c51758ad15c74e797dfc55328a832b15c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    485908d674a80fd4d3fcaa562f9cb927

    SHA1

    402d5f463a81ea1876268d2f39ff7642caffce82

    SHA256

    d5a95ee8df77a4b8d181bd2f971b1e18ef85a0a00c9973bb3f2f1dd6b011c8a1

    SHA512

    9c5d38372ad87f8778c9cd5f8a1aa269c5807df14c7d23cd3234499d39348461baa0e176259ee7e70b52b479355f4ad5c760a931772bdfd5626f482b23e357fd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b9f18a2fd2b503112f52fe440a347e6b

    SHA1

    a973a3a09759e52e05c6cfa7016cd0708fda44f5

    SHA256

    79fd60c890de044974c73e2f5e372a0dbd06175c768cb5ad8280c87a5b69e76a

    SHA512

    1729bee89fe585959bf271fb20fbabcfeb81b6e44559ee6c99521d07fad272ed6c9e37984cefd39075882082f83b42149aeda5a9d0a2a276228e250b86d988e8

  • C:\Users\Admin\AppData\Local\Temp\01CCAE26F1C846128DAC9339E36CC4BA\01CCAE26F1C846128DAC9339E36CC4BA_LogFile.txt

    Filesize

    1KB

    MD5

    973c282a503826f90b87bdb51aabd388

    SHA1

    1e7e63c24ec643eaaf5a4609ca0ed5510e8486c8

    SHA256

    b95c6395a1ba1c2b4197a1e5e537e945e9fd4a78080b1b4af0b06c9d00f16481

    SHA512

    1f90700c5192cc9627225fdc162c5e113be7b52e521bef08eb2673ac1af86d1ccade0cd56bbddc5d3a75b1d89fc7e8ad435a320600e662fd10c3be07f35c57a2

  • C:\Users\Admin\AppData\Local\Temp\01CCAE26F1C846128DAC9339E36CC4BA\01CCAE26F1C846128DAC9339E36CC4BA_LogFile.txt

    Filesize

    2KB

    MD5

    ca390ed6162cd71e25c6cdc95a3240f2

    SHA1

    13aa688e0fa11796855c35d919dff685afe3e0aa

    SHA256

    fb724941a6e915007cc41acdcbe39462feaaab8111be1e4c5f7c0a314465a2b0

    SHA512

    a0317745fae6e916429b3efc79dc05c2068f407f34c0cdd86c8395527045b114a2e344fa24edb53afb7a5a1f915540b860a5b0e878b38e310bc403c7ecc327bb

  • C:\Users\Admin\AppData\Local\Temp\01CCAE26F1C846128DAC9339E36CC4BA\01CCAE26F1C846128DAC9339E36CC4BA_LogFile.txt

    Filesize

    3KB

    MD5

    ba3c74128ae8694070fef1e09cfb08bb

    SHA1

    8c35a2c411dfb0d0bf3ddbf146aebb9729b0b45e

    SHA256

    f0978f0cb5618da482e93a738e94596bf57d5158b2e44fb7048d0468ac14e115

    SHA512

    3c83600ae4e12c6bb6b761752c2b28090209075d8b400951073362f3817bf6cc0908c9d92f09174fee24f4d840e494d4b2192f0ab4030bcad9adf105fa28a7f7

  • C:\Users\Admin\AppData\Local\Temp\01CCAE26F1C846128DAC9339E36CC4BA\01CCAE26F1C846128DAC9339E36CC4BA_LogFile.txt

    Filesize

    4KB

    MD5

    7033bd53c3859b90355bdc7da6e1f852

    SHA1

    902dfa1bf7dda498adb8bace6c33581208e4ae59

    SHA256

    d424d0f8b601e4f875f9bcda2f98d6004a690085f9128ade6db51fe01310812b

    SHA512

    3147150e7f7a091f9ae52140a418c2daa1c8794e013088b476f82dff299d7a52ca3d5c37253f927b0109acd7f998c0cbf28b3c4127c09e233c1e880d8e81195d

  • C:\Users\Admin\AppData\Local\Temp\01CCAE26F1C846128DAC9339E36CC4BA\01CCAE~1.TXT

    Filesize

    26KB

    MD5

    79edf77ba75abec9cc345fc1b41fa498

    SHA1

    d323ef83d0d2a40181dce8d0aab514506cd8771a

    SHA256

    5a309b2976b1d5649763ac77053852799d676c34782cf060d8995e810f90832c

    SHA512

    59441dc873e5efd80a7851eebbc1385b16f0fd4f0613d48c71b5017eb03e1ce20ada4e603192303dc3c3a291e623803c69eda74fd9e7bfd1461f017c57eb8003

  • C:\Users\Admin\AppData\Local\Temp\32068.bat

    Filesize

    212B

    MD5

    668767f1e0c7ff2b3960447e259e9f00

    SHA1

    32d8abf834cce72f5e845175a0af2513b00504d8

    SHA256

    cdb93994093a24991c246d8b6f7003920a510a45bfc8441521314ce22a79191d

    SHA512

    c07f26c8601cf91d9805004668463721ab91e14f3cc59e77e20f43d98e070ea8e742c38fe8021c4ffb1ebc02e3743ab732b66ff84bb24b59a5fdcc8634c77680

  • C:\Users\Admin\AppData\Local\Temp\Cab43B6.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar4427.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\nst3E2B.tmp\internal7e19b2b97cc2e5de685917189f391499.exe

    Filesize

    263KB

    MD5

    fbe8821e8d4e0c942ff348881cc56f97

    SHA1

    cdccd3430a36fc80fcd8e3b2b96160d5d752fb2d

    SHA256

    a05e093023b3a1ea8229d1b65fcd1b3e9942ae5a6777d88dac019b028a3cc045

    SHA512

    5b20a4534a9472f0daa92a53b3edb6d5f0ee42a644ba6a02f851ec2ed05563c7cc852d92f155a8e20f5481e6d2740f36a2b8c4d22fc3770586ece2d76a7f92fa

  • C:\Users\Admin\AppData\Local\Temp\nst3E2B.tmp\internal7e19b2b97cc2e5de685917189f391499.exe

    Filesize

    20KB

    MD5

    ab9de22e53160062fa6e3b228158686d

    SHA1

    d53a4dc920b372f7fecaf09e2a8a1eadbb50c50c

    SHA256

    509f184e8122a7fb186c71bd28276fc0b69f7b254656f068e78db73aa5c47e38

    SHA512

    9be0369c477118389ef63a32b44879b2927a3f70b85f2359a3c3a191dbf757127742dcbe4071f624bd15b0e7d256f6f2e652c3aecc07f455b6dc17e8c0fdaec6

  • C:\Users\Admin\AppData\Local\Temp\nst3E2B.tmp\internal7e19b2b97cc2e5de685917189f391499_icon.ico

    Filesize

    31KB

    MD5

    1f047e870359e4ef7097acefe2043f20

    SHA1

    82ab7362f9c066473b2643e6cd4201ccbf0bb586

    SHA256

    f8aa104cfb7abbceac412d4906ce10f5cf576dd4eb9a525103946d692c55734e

    SHA512

    e4e779676d19d84507250adcffcd9cba99c1666f7678f832c03e41f5f264d16a43ae924d8e29e783d84b2742be1a45803aec99a36b9a3784c4f2d6edd297e286

  • C:\Users\Admin\AppData\Local\Temp\nst3E2B.tmp\internal7e19b2b97cc2e5de685917189f391499_splash.png

    Filesize

    51KB

    MD5

    4d9bc0de818d1666126321b7f5cc1d98

    SHA1

    dc997ab3c7243f7aff0c9744f62413d5669b5681

    SHA256

    33ff0cfbdef3df5ecf79fa9230dde597be6e45df172c991bb12441367a08a3f3

    SHA512

    920a712aa55cac723d386f5cbe21a3bd8305c42d9330e9e16a66ed8706a6185fb60fa7b0308e81206ccc657a795b5ac6cc2ae366bbaa731a73d67be9cd6e97af

  • \Users\Admin\AppData\Local\Temp\nst3E2B.tmp\internal7e19b2b97cc2e5de685917189f391499.exe

    Filesize

    320KB

    MD5

    249269aace547e443f0a7f3bce6b8080

    SHA1

    c55478f0e28a58ff5da10acbc2bb219e4cd946a1

    SHA256

    e59376190e171cb5281e346df1bbfbbf827d92d28722f2a71f14e2058c4ba118

    SHA512

    52f295b509d7c9c02f285cf422e7782e282f5c4822f792dc412f0839ca2e039585caad9f5b347244025e675e2522ce6ca12fcfc86adacf00b74c991474ec15ff

  • memory/2444-387-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

  • memory/2672-75-0x0000000000410000-0x0000000000411000-memory.dmp

    Filesize

    4KB