Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2024, 11:22

General

  • Target

    7cfc56e68da5be8b41aac29cb9828990.exe

  • Size

    223KB

  • MD5

    7cfc56e68da5be8b41aac29cb9828990

  • SHA1

    278d5cbd1c7d729e6fa88268dc1d4e681951925b

  • SHA256

    41ff3badf3e9d87abcbb6bbdbde4a60114cf13a4dc223060a81f8e55e557529a

  • SHA512

    394c0d376d4bb5414a5d0cc76d422a7c9131ecaa0c45be8c85d72b5ff3cc7a968ffb222f3860a9d7837aa20913121670713d2a8477a6c0421e2f3acd036566af

  • SSDEEP

    6144:G2xEFFX3xGfUmGPByCJhe1OaKaOHcz1ADCrMUTHFYOaq:GaEFl3xGfUmGJXefyEvCO

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cfc56e68da5be8b41aac29cb9828990.exe
    "C:\Users\Admin\AppData\Local\Temp\7cfc56e68da5be8b41aac29cb9828990.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\7cfc56e68da5be8b41aac29cb9828990.exe
      "C:\Users\Admin\AppData\Local\Temp\7cfc56e68da5be8b41aac29cb9828990.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2292
      • C:\Recycle.Bin\B6232F3A1D7.exe
        "C:\Recycle.Bin\B6232F3A1D7.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2688
        • C:\Recycle.Bin\B6232F3A1D7.exe
          "C:\Recycle.Bin\B6232F3A1D7.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2756
          • C:\Users\Admin\AppData\Local\Temp\cOSA064.exe
            "C:\Users\Admin\AppData\Local\Temp\cOSA064.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies Internet Explorer Phishing Filter
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recycle.Bin\DDE2F571A4D736B

    Filesize

    21KB

    MD5

    8ee5a1f77f9fd91071101c6d19c08267

    SHA1

    c660f3437d4747037936220102bdcb17fe989296

    SHA256

    55f615467f8d0c24afd97f0b68f82fa9802d5a10d6864641e876758339086fdc

    SHA512

    d5bd54a9789710c710d696d7d85cdda443ab28a961475da43853ec33adf366fb6cb265158eb3572ceada42b8effbdd6b0ba47ce54ab58ddf53668492f48a264e

  • C:\Users\Admin\AppData\Local\Temp\cOSA064.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • \Recycle.Bin\B6232F3A1D7.exe

    Filesize

    223KB

    MD5

    7cfc56e68da5be8b41aac29cb9828990

    SHA1

    278d5cbd1c7d729e6fa88268dc1d4e681951925b

    SHA256

    41ff3badf3e9d87abcbb6bbdbde4a60114cf13a4dc223060a81f8e55e557529a

    SHA512

    394c0d376d4bb5414a5d0cc76d422a7c9131ecaa0c45be8c85d72b5ff3cc7a968ffb222f3860a9d7837aa20913121670713d2a8477a6c0421e2f3acd036566af

  • memory/2232-4-0x00000000024C0000-0x0000000002566000-memory.dmp

    Filesize

    664KB

  • memory/2232-6-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/2232-0-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/2292-17-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/2292-25-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2292-12-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2292-13-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2292-14-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2292-16-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2292-15-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2292-18-0x00000000777EF000-0x00000000777F1000-memory.dmp

    Filesize

    8KB

  • memory/2292-11-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2292-19-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/2292-22-0x00000000777EF000-0x00000000777F1000-memory.dmp

    Filesize

    8KB

  • memory/2292-8-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2292-9-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2292-32-0x0000000000330000-0x00000000003D6000-memory.dmp

    Filesize

    664KB

  • memory/2292-7-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2292-97-0x0000000000330000-0x00000000003D6000-memory.dmp

    Filesize

    664KB

  • memory/2292-43-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2292-90-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2292-49-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2292-88-0x0000000000330000-0x00000000003D6000-memory.dmp

    Filesize

    664KB

  • memory/2292-87-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2292-3-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2408-123-0x00000000777EF000-0x00000000777F1000-memory.dmp

    Filesize

    8KB

  • memory/2408-134-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-159-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-68-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2408-69-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2408-158-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-71-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/2408-72-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2408-157-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-74-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2408-75-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2408-78-0x00000000001E0000-0x00000000001E5000-memory.dmp

    Filesize

    20KB

  • memory/2408-80-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2408-77-0x00000000001E0000-0x00000000001E5000-memory.dmp

    Filesize

    20KB

  • memory/2408-82-0x0000000000DC0000-0x0000000000F84000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-86-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-156-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-155-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-96-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-148-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-145-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2408-99-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-102-0x00000000777F1000-0x00000000777F3000-memory.dmp

    Filesize

    8KB

  • memory/2408-100-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-101-0x00000000777EF000-0x00000000777F1000-memory.dmp

    Filesize

    8KB

  • memory/2408-103-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-104-0x00000000777EF000-0x00000000777F1000-memory.dmp

    Filesize

    8KB

  • memory/2408-106-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-107-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-108-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-109-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-110-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-111-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-113-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-114-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-116-0x0000000077110000-0x0000000077210000-memory.dmp

    Filesize

    1024KB

  • memory/2408-115-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-112-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-117-0x00000000761F0000-0x00000000763B4000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-118-0x00000000761F0000-0x00000000763B4000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-119-0x00000000001E0000-0x00000000001E5000-memory.dmp

    Filesize

    20KB

  • memory/2408-120-0x00000000761F0000-0x00000000763B4000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-121-0x0000000000DC0000-0x0000000000F84000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-122-0x00000000761F0000-0x00000000763B4000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-146-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-124-0x00000000761F0000-0x00000000763B4000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-126-0x000000000BAD0000-0x000000000BB1E000-memory.dmp

    Filesize

    312KB

  • memory/2408-125-0x00000000761F0000-0x00000000763B4000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-127-0x00000000761F0000-0x00000000763B4000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-128-0x00000000761F0000-0x00000000763B4000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-129-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2408-133-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-61-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB

  • memory/2408-135-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-136-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-137-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-138-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-139-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-140-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-141-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-142-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-143-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2408-144-0x00000000025A0000-0x0000000002764000-memory.dmp

    Filesize

    1.8MB

  • memory/2688-34-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/2688-40-0x0000000002690000-0x0000000002736000-memory.dmp

    Filesize

    664KB

  • memory/2688-45-0x0000000000400000-0x00000000004A6000-memory.dmp

    Filesize

    664KB

  • memory/2756-50-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2756-48-0x0000000000400000-0x0000000000463000-memory.dmp

    Filesize

    396KB

  • memory/2756-54-0x0000000000670000-0x0000000000780000-memory.dmp

    Filesize

    1.1MB

  • memory/2756-70-0x0000000001DC0000-0x0000000001ED0000-memory.dmp

    Filesize

    1.1MB

  • memory/2756-62-0x0000000000220000-0x000000000026E000-memory.dmp

    Filesize

    312KB