Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 11:10

General

  • Target

    9703bfbf2193f74c2a9657da6a712f2c.exe

  • Size

    1.3MB

  • MD5

    9703bfbf2193f74c2a9657da6a712f2c

  • SHA1

    98d6a8f91eb0391c56f958acd3d5b7c2b806fd1a

  • SHA256

    cffd3fd4c116eb56dea4b7980ac4a2e7be07944a182eddaa983ecdd2e5a7b79e

  • SHA512

    7f189652ff71aa9dd71e8115a798cab591c50e291f59703a3f57d576e7cffd1f027bf435ab674a850af79a3dfc6d92899489b06f671017a72af1cb536c19d0d8

  • SSDEEP

    24576:xE+/9mM4YahIyZzRD4JCle1Jar1kNYTxrlxTwIhQDiysu3IrAj/Xt:i+/9ShIytRD4sle1JUeYTHZwIhpo3+0X

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 4 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1268
      • C:\Users\Admin\AppData\Local\Temp\9703bfbf2193f74c2a9657da6a712f2c.exe
        "C:\Users\Admin\AppData\Local\Temp\9703bfbf2193f74c2a9657da6a712f2c.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3000
        • C:\Users\Admin\AppData\Local\Temp\NANY.exe
          "C:\Users\Admin\AppData\Local\Temp\NANY.exe"
          3⤵
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3028
        • C:\Users\Admin\AppData\Local\Temp\Stealer.exe
          "C:\Users\Admin\AppData\Local\Temp\Stealer.exe"
          3⤵
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2888

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\NANY.exe

      Filesize

      718KB

      MD5

      b75e313d3096471bd893e213bdaae9d5

      SHA1

      19d260e90680d559b3b8928aa2f74d4514be2225

      SHA256

      ea08abf0bde31916430b058c118788cf32eb602b40f46cd44cddaf31ef68e06a

      SHA512

      5c617d80bf7c20e24a27c5200f39c06bf8c47c64266b4f64b15bc8e8b5611f75fa394d017a140cab257e4397ca5c31787c2af98fc4b549d4a796852960f6b11e

    • C:\Users\Admin\AppData\Local\Temp\Stealer.exe

      Filesize

      768KB

      MD5

      0664b2cf168fe8f3199730160afcf4d7

      SHA1

      585bd1c07060b1db76b4f5b37a0f40458f2fd01f

      SHA256

      2def416c0467fefce46743f7f5e73225d7b97587e9f816e94874ce813a1b2dbf

      SHA512

      5de165ed469072054fbaa00897b09270f9b7673ef4c302ed4922ec0621317891ca579ff87b74d0b1bedae792aaf4bf15f2312bdcad53a41baef22b6f4ee0a7d2

    • memory/1268-37-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

      Filesize

      4KB

    • memory/1268-34-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

      Filesize

      28KB

    • memory/2888-67-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-66-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-74-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-73-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-24-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-72-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-26-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-71-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-70-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-69-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-30-0x00000000061B0000-0x0000000007212000-memory.dmp

      Filesize

      16.4MB

    • memory/2888-68-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-65-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-60-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-61-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-62-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-63-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/2888-64-0x0000000000400000-0x00000000004C7000-memory.dmp

      Filesize

      796KB

    • memory/3000-22-0x0000000000400000-0x0000000000583000-memory.dmp

      Filesize

      1.5MB

    • memory/3000-0-0x0000000000400000-0x0000000000583000-memory.dmp

      Filesize

      1.5MB

    • memory/3000-12-0x0000000002570000-0x000000000265F000-memory.dmp

      Filesize

      956KB

    • memory/3000-13-0x0000000002570000-0x000000000265F000-memory.dmp

      Filesize

      956KB

    • memory/3028-48-0x0000000000400000-0x00000000004EF000-memory.dmp

      Filesize

      956KB

    • memory/3028-46-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

    • memory/3028-31-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

    • memory/3028-25-0x0000000000400000-0x00000000004EF000-memory.dmp

      Filesize

      956KB

    • memory/3028-23-0x0000000000400000-0x00000000004EF000-memory.dmp

      Filesize

      956KB

    • memory/3028-14-0x0000000000400000-0x00000000004EF000-memory.dmp

      Filesize

      956KB