Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2024, 06:32

General

  • Target

    7f2330def39913a8dfa6252f81637197.exe

  • Size

    249KB

  • MD5

    7f2330def39913a8dfa6252f81637197

  • SHA1

    5f4e7714e7a278ad5279a62f1b352e80252c934d

  • SHA256

    9de7bad6c008475fc6b83764c55296f7e45a32342c445c46ce3e384737ad30fe

  • SHA512

    e26e44875fcb4d963b44352abacb537cd2df9a3feeffe03521b0e6858287d98e8c1c48f377bf5ed314e062c6b7a89f3c5b5932e41f57601dbae8e69988b1cb47

  • SSDEEP

    6144:IM0Ky/jFZofhxOeqKlusmJTZVDcgR2Ge0Uxe955WMenawoS:IM0KybFZShMeqqufpXDJQGexGjHwoS

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f2330def39913a8dfa6252f81637197.exe
    "C:\Users\Admin\AppData\Local\Temp\7f2330def39913a8dfa6252f81637197.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Users\Admin\AppData\Local\Temp\7f2330def39913a8dfa6252f81637197.exe
      C:\Users\Admin\AppData\Local\Temp\7f2330def39913a8dfa6252f81637197.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Recycle.Bin\Recycle.Bin.exe
        "C:\Recycle.Bin\Recycle.Bin.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Recycle.Bin\Recycle.Bin.exe
          C:\Recycle.Bin\Recycle.Bin.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2844
          • C:\Users\Admin\AppData\Local\Temp\SaK4395.exe
            "C:\Users\Admin\AppData\Local\Temp\SaK4395.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies Internet Explorer Phishing Filter
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recycle.Bin\config.bin

    Filesize

    4KB

    MD5

    649ff12ebf081a1e7f3a283753b82a1b

    SHA1

    c79757cfa811a1d27a7bae0c3f366c779aab457a

    SHA256

    311da4bc1cd00e3d85994738b84171ca59d69ff70fea4c8e94d831199d2a4097

    SHA512

    61b27d2d184efe36765eb1a303dcd19ec6395b748b06ce9d43cb547fd5842e2f26839821a8851b56083192f5aed6827deeaeedd80cd9315476042283d120ac73

  • \Recycle.Bin\Recycle.Bin.exe

    Filesize

    249KB

    MD5

    7f2330def39913a8dfa6252f81637197

    SHA1

    5f4e7714e7a278ad5279a62f1b352e80252c934d

    SHA256

    9de7bad6c008475fc6b83764c55296f7e45a32342c445c46ce3e384737ad30fe

    SHA512

    e26e44875fcb4d963b44352abacb537cd2df9a3feeffe03521b0e6858287d98e8c1c48f377bf5ed314e062c6b7a89f3c5b5932e41f57601dbae8e69988b1cb47

  • \Users\Admin\AppData\Local\Temp\SaK4395.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • memory/1504-21-0x00000000773CF000-0x00000000773D1000-memory.dmp

    Filesize

    8KB

  • memory/1504-7-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1504-11-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1504-13-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/1504-3-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1504-14-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1504-15-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/1504-17-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/1504-16-0x0000000000030000-0x0000000000031000-memory.dmp

    Filesize

    4KB

  • memory/1504-5-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1504-22-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/1504-9-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/1504-30-0x0000000000AC0000-0x0000000000E12000-memory.dmp

    Filesize

    3.3MB

  • memory/1504-54-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/1504-34-0x0000000000AC0000-0x0000000000E12000-memory.dmp

    Filesize

    3.3MB

  • memory/1504-85-0x0000000000AC0000-0x0000000000E12000-memory.dmp

    Filesize

    3.3MB

  • memory/1504-87-0x00000000005F0000-0x00000000008BF000-memory.dmp

    Filesize

    2.8MB

  • memory/1504-42-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2432-0-0x0000000000400000-0x0000000000752000-memory.dmp

    Filesize

    3.3MB

  • memory/2432-12-0x0000000000400000-0x0000000000752000-memory.dmp

    Filesize

    3.3MB

  • memory/2696-39-0x0000000000400000-0x0000000000752000-memory.dmp

    Filesize

    3.3MB

  • memory/2696-37-0x0000000002CC0000-0x0000000003012000-memory.dmp

    Filesize

    3.3MB

  • memory/2696-32-0x0000000000400000-0x0000000000752000-memory.dmp

    Filesize

    3.3MB

  • memory/2724-81-0x0000000000160000-0x0000000000165000-memory.dmp

    Filesize

    20KB

  • memory/2724-90-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-68-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2724-70-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2724-117-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-72-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2724-77-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2724-115-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2724-76-0x0000000000160000-0x0000000000165000-memory.dmp

    Filesize

    20KB

  • memory/2724-62-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2724-82-0x0000000002410000-0x0000000002450000-memory.dmp

    Filesize

    256KB

  • memory/2724-80-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2724-83-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/2724-74-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2724-114-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-113-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-112-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-84-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-111-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-88-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-89-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-69-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2724-92-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-91-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-93-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-94-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-110-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-109-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-97-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2724-98-0x0000000002410000-0x0000000002450000-memory.dmp

    Filesize

    256KB

  • memory/2724-99-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-100-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-101-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2724-108-0x00000000028D0000-0x0000000002A94000-memory.dmp

    Filesize

    1.8MB

  • memory/2844-96-0x0000000001F00000-0x0000000002010000-memory.dmp

    Filesize

    1.1MB

  • memory/2844-50-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2844-49-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2844-48-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2844-60-0x00000000002E0000-0x000000000032D000-memory.dmp

    Filesize

    308KB

  • memory/2844-47-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2844-79-0x0000000001F00000-0x0000000002010000-memory.dmp

    Filesize

    1.1MB

  • memory/2844-67-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB