Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 12:46

General

  • Target

    SecuriteInfo.com.Trojan.MulDrop3.26100.10656.22623.dll

  • Size

    1.8MB

  • MD5

    ff9f837f2e437d55dab3110bfc17b0a2

  • SHA1

    bf3a403e81a5db31e8ea3d34f01408ba47d1fab6

  • SHA256

    6ac207559706d6f6e7f95d6cb3754f75e9f0b3b962cadb2a3f85a46a1aff3422

  • SHA512

    d1a161567514bba1e20d53334e23bf654416d91261ec3981dde65a846f584b03a90abee534fe93973b28389a83e2293c7619ba58f1a0b35a5b4a899143362947

  • SSDEEP

    24576:203bWVWrpjTfAVkpy+WH1/Q0cisbEqwV47AaZbTaA3ssy3ll43I5xMVsbOOOjygs:5bEQj4m9nIFVsL/Tc5lGsiojtqIbb

Malware Config

Signatures

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop3.26100.10656.22623.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MulDrop3.26100.10656.22623.dll,#1
      2⤵
      • Identifies Wine through registry keys
      • Checks whether UAC is enabled
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1612
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.feichemeng.com/
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3064
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ef2b2b1105d32e7e55c556c3f3543681

    SHA1

    09e857097eef08fcebd81b87d2cf0c07b26009fb

    SHA256

    106938ffb8a4aadbb7a54d13859a3b6afb70026d752e723ce2bcada2b3cd6a5e

    SHA512

    15597658460ad1feac01cd617162e21f2bca87f93bea3749e068d746c31746407be9d67508956d1208e0eb78e4a736c87766a1632c088b03ce580c4557d4bfb3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c23203d1cce4d053a02f3da2a6527f73

    SHA1

    aac2459dcfc43cc7dd0d3122a59ad916af72032c

    SHA256

    ce27cae9f28ef0e548c0347523aaf5308cb9b325a0dff28467c936302b5da3e6

    SHA512

    3a9d42e0e3159c00828650188ddbee0a5fadbd93b92e492ad9e83ea1cbafa19cfecd2610bea16d509755c3f9a575704509566421bdbe60f77918e19c84cb2584

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c7f871bf2fa2ae6232255217aefca3ad

    SHA1

    47ab318cba3fcd775fc9d73bc047b8c6d2b80419

    SHA256

    ad6199bfb9387cb088aa13a7dbd1e3dce0badc15324219bb347c75d2691bf0ea

    SHA512

    dea30412186d6c6378815d07e1edb73887f795e9f3fd2ac15aef263c7b96fdf0ec98af0cc283002f312f0dafeb64b036f640e12909253b3b02a09b7d698906a5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    36ca480e39bce64225d5b5511dbc3f1e

    SHA1

    ef73cb2ccf0c0f29f67f06636840a9767a350fbe

    SHA256

    dc783eb3c07cb27b91f1e93b8e10ab856775d2be539f16551d590389c994b1fc

    SHA512

    e96dde412f7f068a0f96fde912c0c4557658af114005dc90ccd300317462bdecdd5d36d76a3d1701464d97fcd5e9c03221cdb5d356ab042e3963657f5bc1abc8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2a7f5e2aa5815a811daceabea7e5daa1

    SHA1

    51d1e0c71665d52e9a53876214dac39a38f7c939

    SHA256

    a0c30a71dd2988e8f3dd3d16a4cbd2706b0efd7e9f6a3e7d9783856cc6635a9f

    SHA512

    0ce037ec8e127c26282137cf724c08e6701c322421afec06208a40d0d61e07225763f2cfb99d929514f8efbfa0526efc1f21873fecf63fb64cecf6b6773a4001

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d84797c62985a2cbee2fe27a6247f2bc

    SHA1

    8d6e9d7dd754dd2e4661d8e2ebc6230cddca2dda

    SHA256

    1c45edc3e2e671642e43aa9f1d92942ed52b25ab9a68a585a488d9af40e34296

    SHA512

    36f613d418225f132eaebd6630fff0267143e2dc0c50dc21643a6332fdcef6d16775f977947299f5e3f6f85128d2f4ab0b14ad3300d8be2645bd6f01201facff

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8fc2ecb2a2ed19e6f38446c09b837aad

    SHA1

    0afe28b657ef4f34dc04af1f0a0218738e14566a

    SHA256

    0dbb76b917a63d242ac34e1597a94e502b2c509ffad4309b607ca6aea6cca993

    SHA512

    801d66b48e3ea626b60ef68874ec5481d5095716b3799003b79594eda4c11dce07c84c5227c358eb2e30a426464126ede7e1bc88c2f0d780a26e66c1369b315e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0d84c9fe323f488fa6799122d8c28e25

    SHA1

    0e7abd381f50e0b3e1377288dfd6575394eea0e9

    SHA256

    41db52c429b6c34502cfeed32072040897f2e83163f615d375a50f5d55ac5a29

    SHA512

    e874f13fb2a2fd4c186e939110c07cb3f57da62d9473c66163a3f2e485e3b7f5f465b8830c54375ff534ac077728e31f3e2724bce360048178d8d31f764da7c1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    64346611fe38ba9a79a2effd03435be1

    SHA1

    a7a3f70321a52b28b6440d4cb6f8d83e8cbee172

    SHA256

    8ca3ef9f42f8d05b6a15bbfdd4068b73618b566d25279d14a9f791ead75a8787

    SHA512

    57658ae083efc63f5faa500b076ce6c07ccef500a5c514b472ff22c3841a537c2b6f064435cf44f0250110cbeae763a79942cce31b30dace938654d6f65a3fac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4c8fc1215395b1ccb885efbfcb3bce93

    SHA1

    f52ef9784f42224a5453dc66a68f0eea7b278588

    SHA256

    f488e659b073f23bc96004f5b8e6dd638e29beb373cafa1bde8926067ca8b5d7

    SHA512

    0a33d01833b0326eeb0d027100cfa0502fa9dea0c2a4542ec314f822be1f342c421708b70fd0236062ecb1d6fbb704025b44f05f294886b0c66422ff89890fb7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    35b34b13209e11b6ed62cac66800c313

    SHA1

    83720d5f6a0e4b120e50249c6f1f6769491988fc

    SHA256

    bd110ea5c17492693492758485780dc6a679918786d0a49e6141dab174cc0c5b

    SHA512

    1d1a1da62697eb85ee124a259e2718c589c88f6de51005872ec16ff522c46e2a00ddb32dc6d430a0ad42c7acb007a9396059e830a366e34f8d3e06a9fa3d7e70

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3b65d35c0a15cabc6d4dc5d5b90b0f49

    SHA1

    81aca95ae2f3c3c4b9846ef2649128b9836db0c3

    SHA256

    b684fc246cb449a2313a9f0de71d6edc778097b2864e83cbfe48da2bec58590f

    SHA512

    a03f13d50c6c3b5a48711274878ebe29df1ca7590a7b0cb42be3a994f0d280fc805601a45da5144a3b28c3f36d93ec89c4d553e0004c1e59f39cc3918b9fb504

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b080d22e8fc27b642fb58a60d3400549

    SHA1

    3e76ae82891d43033da47cd9d458077d89d7ceff

    SHA256

    580ba9e3ab8cd4b8e6e9259e82c403da1dc0a9922229cae7cedda77af8c89daf

    SHA512

    cfe7e50385586bb72f3e10762a23b9b5d34ddcbeade01adcbcf34dcf3cb20dfdc19617ae12e6d8a3cae638f500947f6618ad998f5ad5a3d92f470d64d9b80562

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a10f4cac26916843db7bcb42c6c98173

    SHA1

    980b36a137dc1e910890eb0c952d0b85f26eb841

    SHA256

    f035b5f2b0da7d659ce1621f84431982148b7c745bb8ec62d9f9862af6726a66

    SHA512

    5edfa1d1a730241d49dcf98a5cf13e96b74ed7e2952838d107f47e4448d1f56eb6260ae93be54b8fb6a59e68c1fdbf430100123a304c7e897c2f50b22a404fd3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    29b5583de2c8bd85aa418275dd50d8ae

    SHA1

    bccf7987e9e0590cc2df798e1e330ad4026a57de

    SHA256

    dc780ebbf42e54a938499b712dd6512f378c5fed9a5abcf7603fd519f17a0454

    SHA512

    0cb2151f554c8ed717e9b4a8764e58958b6721c31a76223c652915a77f28c916859018e510f26950ae4b6c51eb1dfe7cc24de7b26d59846e498d0906c82ab20e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4de4d627caef41e6f446ebb31e36a12c

    SHA1

    02fe9934392cff27da939663f06c557ed4611e60

    SHA256

    bf2a8adacdb055a33734776ab1462a6e1bb3decd4bc0367ce023e7ae2d562231

    SHA512

    fbc54e9ca5750db135c1568d89d5445e0678d74c5d7886b0196b5539189cd8cd0045a9f33fda54ff1f21b9931f093e13104ab7ac012ec7f650326dc394e65fb0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3fe504d16aee86926eb6580c20cb5570

    SHA1

    1305ea8ed08a6605b3ce6403b308de11a9a4d33d

    SHA256

    921b88a6f40dcd77c4a1059c9c3b36f5d0ae1a327a51589bb0b936ac1c2ed8b0

    SHA512

    cfdb7529a8c23f5c02fb7520185084ed4597b218209dfb32e186596b2e2d1d47c29cf6fb15b25cda90b428d96d89279565da0fc790a1427294a8e99cd1b6e952

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    159bd7fee7c1fa067bd0fc2e897916f2

    SHA1

    433d65ff2196e3782e507bb6db492e23684612ef

    SHA256

    ed4ebff9bdcff920eef55865e60d6b9be30eaa9a1d6676fdf23ee1d04ef5e77c

    SHA512

    421b45a806ef62c9eaa371e5b45db7e1855ba1a3a288e85ead1f8da8d651a3a6a92a7e4f0be6372183a99fd8f5565ea1b48465af54ac127bb10741c1df7bc69c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    173ad510908dbb82f0fd9ba047c14426

    SHA1

    1b52d152bf40269400ae8d0b4f1f35e81862e4dd

    SHA256

    3bebba2dfe576ca01d4cc1ba425170d91422ce3e1b9ef2502c69802b00b931d8

    SHA512

    015290607362082038af10b358c42ca514d9c8bc575887ce8e0a789c0bc62d6314de687619ec07a8636abb2fcf6bbf48675ba18e943defdce9b25acec5a235c3

  • C:\Users\Admin\AppData\Local\Temp\Cab3B10.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar3BAF.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/1612-7-0x0000000000AF0000-0x0000000000AF2000-memory.dmp

    Filesize

    8KB

  • memory/1612-0-0x0000000010000000-0x0000000010360000-memory.dmp

    Filesize

    3.4MB

  • memory/1612-1-0x0000000010000000-0x0000000010360000-memory.dmp

    Filesize

    3.4MB

  • memory/1612-2-0x0000000010000000-0x0000000010360000-memory.dmp

    Filesize

    3.4MB

  • memory/1612-3-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

    Filesize

    4KB

  • memory/1612-4-0x0000000000B40000-0x0000000000B41000-memory.dmp

    Filesize

    4KB

  • memory/1612-5-0x0000000000B50000-0x0000000000B51000-memory.dmp

    Filesize

    4KB

  • memory/1612-6-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

    Filesize

    4KB

  • memory/1612-81-0x0000000010000000-0x0000000010360000-memory.dmp

    Filesize

    3.4MB

  • memory/1612-80-0x0000000000F30000-0x0000000000F3E000-memory.dmp

    Filesize

    56KB