Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    04/02/2024, 20:45

General

  • Target

    901d946782b7cdcca330975a6729b6ca.exe

  • Size

    325KB

  • MD5

    901d946782b7cdcca330975a6729b6ca

  • SHA1

    1316a5bfce6e0fe11ca479cf15313d3ffdd8230e

  • SHA256

    11b160985512a52e0370df2e033ee365624938201c0a0c9ec43b18c1feb58c2e

  • SHA512

    d81aa5b1696fd5988932571ba78bc79d0f5a526f680ae5501ff876141c9309d5123f2abfcb91346635bf685c4c9848c45174141ce702b11b0443ee3b6d8f0b90

  • SSDEEP

    6144:Er1Bh9uEo2S1YnQmCX492DkwNP3qpYFDcYgQUskKWeFCEQOiCYOqmO5oe:Er1B3u6/eIo4ArVUBQCCYOqmO5oe

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\901d946782b7cdcca330975a6729b6ca.exe
    "C:\Users\Admin\AppData\Local\Temp\901d946782b7cdcca330975a6729b6ca.exe"
    1⤵
    • Loads dropped DLL
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:952
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin9F8B.bat"
      2⤵
        PID:3028

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\InstallMate\22155315\cfg\1.ini

      Filesize

      814B

      MD5

      bd5e1676bd73896be4774e1f5b1f3e28

      SHA1

      fa2fc102b6b4f56317e4af04c0373ffa369498fa

      SHA256

      4f38c3e2ff80b27b939625bb197d9972dce1ed130179349f6c213c6520461086

      SHA512

      c9e1d8a0e37f869b2d07b02152fdce80a9a15a4c4ce67ec50c494f0426e33f3f5a4af45a5e3efd297870bf18bee12f1ad0c68900a9fe46235f9c9f565d3f8b78

    • C:\ProgramData\InstallMate\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\Custom.dll

      Filesize

      59KB

      MD5

      05540c9920d602c69ff2781ea01eac29

      SHA1

      c43ecaa5c12bc9541115482f8a164ada8fdeb29a

      SHA256

      1aeb2c74ee76442b50816d039dec3ca7f231e5a6a762ff38fb79a3b0ce66e285

      SHA512

      0d995e9481767cd607e073e8665169600d44732678b1573fa880dc8123ed960593a3f588032a933fceef2b834d6a575419443fd5f5d5c2b44d159a02d15cbdff

    • C:\ProgramData\InstallMate\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\TsuDll.dll

      Filesize

      155KB

      MD5

      7b69064f9d8ed16762a75ee0d5a256cd

      SHA1

      cfbc959d936c81641ba7d8b220a3c42be26633e2

      SHA256

      d7e3abcc7181b60ab143138d97b54258693418ca0848db9621045dd7c7c8f988

      SHA512

      4b859da41e01bbef00292f6088b9948bd30a8520b0b3ae023e0580f07f75f5cd2875c599e18d02937114bdc5ac2bbe60f497adcf6df0619b55aec083635a454a

    • C:\Users\Admin\AppData\Local\Temp\_tin9F8B.bat

      Filesize

      50B

      MD5

      e8085be36abd023c2ae7731c3f113d85

      SHA1

      d07bb13f261ac98b825a9f1f4de88d0d38c66df9

      SHA256

      94f5b7b53363318c555575e42974cb8850ef7552b0fff243f1fed2bd58fb68e0

      SHA512

      57f2ceae004ac94f4caf2c053f6c9e4d3621271cda2529eef7d369d3ea8c79d91ee1a70631da22ce5adbafde74adf585b50437ad86a3de4f90832c6e099b1799

    • C:\Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\Readme.txt

      Filesize

      2KB

      MD5

      cb45f741900f51ed947f0c8061884c9f

      SHA1

      3c63ff4c2039094b8e86ae28d17968563061f62f

      SHA256

      6f1bd3c9e1ad5ed8b04a016ab26252627c47e527a75925080828db051387f3d5

      SHA512

      d42b62f1ad800968e19dcdd00658cd77c6106e740456b193d08141af974cf8e6f59c9551489922e160ae23a84e39d2132150fee8cf3a663d0db35516af957000

    • C:\Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\Setup.exe

      Filesize

      15KB

      MD5

      e717f6ce3a7429bfa6d7f3cf66737a4b

      SHA1

      01f4042589b4ed88c351ffeac256be7a9d884818

      SHA256

      7be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633

      SHA512

      65a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80

    • C:\Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\Setup.ico

      Filesize

      14KB

      MD5

      1623bb0c615eaeed406a3253a606e71c

      SHA1

      e86516e730bdd2a6d0423211f236f4ae9dd4282e

      SHA256

      67664b6561b8bf32091bca59db37a8c8099da01236accfa85f1367bdcb5f0904

      SHA512

      2d854d2732d9562acfe01350fbeb0b78339d01630f114f8c5f95f7542fff2af93393b5c4f977d9602d78dbea23bf41f2f1a9b0252e51a66971facf208803ec5d

    • C:\Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\_Setup.dll

      Filesize

      167KB

      MD5

      491646f23ccbd43f0bfe69e5d5bfe33e

      SHA1

      351ce0bb9306c91c11c1c795e6bd336bb5c4e09a

      SHA256

      b5a086b1341b9ed1adee6f2c98a77660eb076e09c1e4d5d4f51cba3e22409ba7

      SHA512

      47a828e5a4cb0566baeb06db27f8ff393612b1c63dd1e401b383ede5fd1b62510f52bfb4e66e6da6d5f5eb7121a016e0a364f6166b3ec13dffd483c650ccfb12

    • \Users\Admin\AppData\Local\Temp\TsuD268C42D.dll

      Filesize

      269KB

      MD5

      af7ce801c8471c5cd19b366333c153c4

      SHA1

      4267749d020a362edbd25434ad65f98b073581f1

      SHA256

      cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e

      SHA512

      88655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c

    • \Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\Custom.dll

      Filesize

      91KB

      MD5

      736682c6d96bb1edc84e77041faae33d

      SHA1

      f8f6e20cd2aa23010b85ea289c3bc3cbdbc9ae26

      SHA256

      54346f2e36bdb512ef4f7d702f18e59a746f0b936786bc76a30e87de0a061f17

      SHA512

      fe24353f0f4acafbde7d8cec7a5078668f5e6cd0b06c3e0c96cb3fed0beb3c8af2becb1d97fcbb369ac38193827c8d8a440694c79b5da3180224377e38f53777

    • \Users\Admin\AppData\Local\Temp\{113C77E0-9889-4531-A7DA-D0ABCADF5516}\_Setup.dll

      Filesize

      180KB

      MD5

      a475792794328d8a503568cbe38e8531

      SHA1

      47e5c4857f272898ed515e939f92cb9243b2ce2e

      SHA256

      2cd6c67a711059c2245615d80ee0e7d44a003b66d5577513b1dfb1bd7f1e7312

      SHA512

      3ea14ace569233dd69e730b4dfae4f1292d2e950aa26aceeae78715d0831ff6919d1bbf7c70ec256dd8a5db7f2d09ea4f29a564c125b54fdf8c7de2c78631184