Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2024, 04:04

General

  • Target

    7ed6669275b4f7ef72fcb5ca59eafff4.exe

  • Size

    576KB

  • MD5

    7ed6669275b4f7ef72fcb5ca59eafff4

  • SHA1

    bc281b10918e351939cabf0b9ad94714391efa1e

  • SHA256

    3d67d225b2cb66e45dab3b88eefc316d6b5da7648f3a4e13939058d64943daf0

  • SHA512

    3c62d5e90e004db2e46208f78fdd770ff18795fe7332af1ce0d684263b3ad7fd90108bf301e6d278cfc7adc470a7fa1b225dd56ab0fd752216f68eb909330aba

  • SSDEEP

    12288:CVEeMMiPTI538Faif9HLR5O6IyfruKv91zNCe88wYUxB+x2Y:COkaC3ViFrnO6Iyf7vQYj2Y

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ed6669275b4f7ef72fcb5ca59eafff4.exe
    "C:\Users\Admin\AppData\Local\Temp\7ed6669275b4f7ef72fcb5ca59eafff4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Admin\AppData\Local\Temp\7ed6669275b4f7ef72fcb5ca59eafff4.exe
      "C:\Users\Admin\AppData\Local\Temp\7ed6669275b4f7ef72fcb5ca59eafff4.exe"
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Users\Admin\AppData\Local\Temp\7ed6669275b4f7ef72fcb5ca59eafff4.exe
        "C:\Users\Admin\AppData\Local\Temp\7ed6669275b4f7ef72fcb5ca59eafff4.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2808
        • C:\Recycle.Bin\B6232F3A5CC.exe
          "C:\Recycle.Bin\B6232F3A5CC.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2656
          • C:\Recycle.Bin\B6232F3A5CC.exe
            "C:\Recycle.Bin\B6232F3A5CC.exe"
            5⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2644
            • C:\Recycle.Bin\B6232F3A5CC.exe
              "C:\Recycle.Bin\B6232F3A5CC.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1848
              • C:\Users\Admin\AppData\Local\Temp\F7J4624.exe
                "C:\Users\Admin\AppData\Local\Temp\F7J4624.exe"
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Modifies Internet Explorer Phishing Filter
                • Modifies Internet Explorer settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recycle.Bin\3C1A81EFE5691D3

    Filesize

    320KB

    MD5

    5ea1ba0c78b899b81e777e106cf417d0

    SHA1

    c31ef3cb409d9fe27971e20ffcdd7ad3c60c14f4

    SHA256

    ef0ff68430371ac2a50054b6c35f2a5832f1b56a6946bc8c62ff050be2686f60

    SHA512

    91963381e780021391d56513a0d232445ee1ccfd49baae3831fbcd0e539fab9e008393913cba72d7011aff39a139d0e45cefcfd4024c2cd062b57d2b382e04ce

  • C:\Users\Admin\AppData\Local\Temp\F7J4624.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • \Recycle.Bin\B6232F3A5CC.exe

    Filesize

    576KB

    MD5

    7ed6669275b4f7ef72fcb5ca59eafff4

    SHA1

    bc281b10918e351939cabf0b9ad94714391efa1e

    SHA256

    3d67d225b2cb66e45dab3b88eefc316d6b5da7648f3a4e13939058d64943daf0

    SHA512

    3c62d5e90e004db2e46208f78fdd770ff18795fe7332af1ce0d684263b3ad7fd90108bf301e6d278cfc7adc470a7fa1b225dd56ab0fd752216f68eb909330aba

  • memory/1848-90-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/1848-101-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/1848-103-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/1848-105-0x0000000000220000-0x0000000000266000-memory.dmp

    Filesize

    280KB

  • memory/2320-12-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2320-71-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2320-17-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2320-14-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2320-210-0x000000007748F000-0x0000000077491000-memory.dmp

    Filesize

    8KB

  • memory/2320-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2320-6-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2320-4-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2320-2-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2644-76-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2644-84-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2808-31-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-45-0x000000007748F000-0x0000000077491000-memory.dmp

    Filesize

    8KB

  • memory/2808-35-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-36-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-37-0x00000000006C0000-0x00000000007D0000-memory.dmp

    Filesize

    1.1MB

  • memory/2808-34-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-32-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-38-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/2808-39-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/2808-33-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-30-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-28-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-27-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-18-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-50-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2808-74-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-22-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-25-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2808-20-0x0000000000400000-0x00000000004A7000-memory.dmp

    Filesize

    668KB

  • memory/2980-131-0x0000000000390000-0x0000000000396000-memory.dmp

    Filesize

    24KB

  • memory/2980-182-0x0000000076EA0000-0x0000000077064000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-100-0x0000000000220000-0x0000000000266000-memory.dmp

    Filesize

    280KB

  • memory/2980-112-0x0000000000220000-0x0000000000266000-memory.dmp

    Filesize

    280KB

  • memory/2980-130-0x00000000006D0000-0x000000000071C000-memory.dmp

    Filesize

    304KB

  • memory/2980-129-0x0000000000670000-0x00000000006C4000-memory.dmp

    Filesize

    336KB

  • memory/2980-145-0x0000000077491000-0x0000000077493000-memory.dmp

    Filesize

    8KB

  • memory/2980-144-0x000000007748F000-0x0000000077491000-memory.dmp

    Filesize

    8KB

  • memory/2980-148-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2980-137-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2980-154-0x0000000075040000-0x0000000075140000-memory.dmp

    Filesize

    1024KB

  • memory/2980-157-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2980-166-0x0000000076EA0000-0x0000000077064000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-168-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2980-156-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2980-125-0x0000000000340000-0x0000000000345000-memory.dmp

    Filesize

    20KB

  • memory/2980-171-0x00000000751F0000-0x0000000075225000-memory.dmp

    Filesize

    212KB

  • memory/2980-174-0x0000000000380000-0x0000000000385000-memory.dmp

    Filesize

    20KB

  • memory/2980-176-0x0000000076EA0000-0x0000000077064000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-177-0x0000000003110000-0x00000000032D4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-178-0x0000000076EA0000-0x0000000077064000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-179-0x0000000000220000-0x0000000000266000-memory.dmp

    Filesize

    280KB

  • memory/2980-181-0x0000000000340000-0x0000000000345000-memory.dmp

    Filesize

    20KB

  • memory/2980-121-0x0000000000330000-0x0000000000335000-memory.dmp

    Filesize

    20KB

  • memory/2980-183-0x000000000BAD0000-0x000000000BB16000-memory.dmp

    Filesize

    280KB

  • memory/2980-184-0x00000000035E0000-0x00000000037A4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-186-0x00000000035E0000-0x00000000037A4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-185-0x00000000035E0000-0x00000000037A4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-187-0x00000000035E0000-0x00000000037A4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-189-0x00000000035E0000-0x00000000037A4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-188-0x00000000035E0000-0x00000000037A4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-190-0x0000000075040000-0x0000000075140000-memory.dmp

    Filesize

    1024KB

  • memory/2980-192-0x0000000076EA0000-0x0000000077064000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-193-0x00000000751F0000-0x0000000075225000-memory.dmp

    Filesize

    212KB

  • memory/2980-195-0x0000000076EA0000-0x0000000077064000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-196-0x0000000076EA0000-0x0000000077064000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-197-0x00000000035E0000-0x00000000037A4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-110-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/2980-235-0x0000000003620000-0x00000000037E4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-237-0x0000000003620000-0x00000000037E4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-238-0x0000000003620000-0x00000000037E4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-241-0x0000000003620000-0x00000000037E4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-240-0x0000000003620000-0x00000000037E4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-242-0x0000000003620000-0x00000000037E4000-memory.dmp

    Filesize

    1.8MB

  • memory/2980-239-0x0000000003620000-0x00000000037E4000-memory.dmp

    Filesize

    1.8MB