Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    40s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 00:13

Errors

Reason
Machine shutdown

General

  • Target

    97fb18226b9e973c999ed8547efd5ddc.exe

  • Size

    642KB

  • MD5

    97fb18226b9e973c999ed8547efd5ddc

  • SHA1

    37bede16538d59b8a1023a329e17f25e82df6665

  • SHA256

    7f5bd953de51989a7ed7e5151b43d280af2eeffff1453b198dd6c877e86d8116

  • SHA512

    c5c5656bdb269e19fc093ea7e7d1c2f6635bb191b45dc0fafab666e25203b51e2f09ca9875aee1d3ed9e21a77afe75c872e033e734e6e1bac1e8e33b844f203e

  • SSDEEP

    12288:z/xXCiWWuEFo0tDap7uL47ikBwjsW77zfx2WbgSrSw9B67mAyd9qU8YIWKnW:td2EFntk7uE7TwjTrfx2DSr9B6nynvNK

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Maps connected drives based on registry 3 TTPs 5 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97fb18226b9e973c999ed8547efd5ddc.exe
    "C:\Users\Admin\AppData\Local\Temp\97fb18226b9e973c999ed8547efd5ddc.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Maps connected drives based on registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2324
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:1288
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:1700

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\MYPNGI1.jpg

        Filesize

        515B

        MD5

        7f7112e9c3de0d48e8198b74207b5c03

        SHA1

        d8acfb4a14d3cb8279c39f9d18780aec261b627a

        SHA256

        d4d5fb19b9a21aa609c5f91c35d3d9dcd4c62071769b332406cc23215bb66ee7

        SHA512

        9bed65083205866140d3f70d217a19ba75a443a58554748eac5edebf62201b08edb70bef0a28997447878db151dad62d0849014515c2c4767654b625e03f0a7d

      • C:\Users\Admin\AppData\Roaming\MYPNGI16.jpg

        Filesize

        500B

        MD5

        212a6d2dbd5c89a3ffe47bcdd5b43504

        SHA1

        3cbc32e292fb3a29e7df59026839f435cfa0fda3

        SHA256

        197afe35f7607e225fd49d829e4c28608441c3fd8ce209daa171df675611bbb2

        SHA512

        b2ce9af36e1c07ebdeac12c20038b01a48eb728f8094ee25eafac6e8152049e02694f936783a2fe41d61312be74781b01b5f8553eb2f954becee428851189c3b

      • C:\Users\Admin\AppData\Roaming\MYPNGI20.jpg

        Filesize

        694B

        MD5

        175412ff945c4d15eb6cd3b393d130c2

        SHA1

        2c83768848611756b277579f55f7f3a40ebee103

        SHA256

        f9b7e03583ee87205d7c7e9e10dd9d2dfc94415e63c05203fda70431423a5f03

        SHA512

        5dab37093e665a9fab279a71f0057253ac6676d0796c9b8c6cb69b403e44a3fadf62c353bb96bbf494ad87115b8199b6ed18b522ecc3a075dbc62c9e73b830a6

      • C:\Users\Admin\AppData\Roaming\MYPNGI8.jpg

        Filesize

        12KB

        MD5

        1bd1cb93fac0acc948d65c51ab5489b4

        SHA1

        64ff1ef70e25554de420ef5da917e710937c03e9

        SHA256

        1183daa52f3ff1aab9aec0e23ec92d6185e601f77f6944501d6fe5b3598518a4

        SHA512

        45c7edb9f74d39c972226be0e7bf0213cc417ae2a8c0536a3761dddd02a8c3b4df8b2f316bf88e5979fc0d1e732e7e9f686245318a1cb3e48f901ee0e0ee77d5

      • memory/1288-108-0x00000000029C0000-0x00000000029C1000-memory.dmp

        Filesize

        4KB

      • memory/1700-109-0x0000000002760000-0x0000000002761000-memory.dmp

        Filesize

        4KB

      • memory/2324-0-0x0000000000400000-0x000000000057E000-memory.dmp

        Filesize

        1.5MB

      • memory/2324-48-0x0000000000400000-0x000000000057E000-memory.dmp

        Filesize

        1.5MB

      • memory/2324-76-0x0000000000400000-0x000000000057E000-memory.dmp

        Filesize

        1.5MB

      • memory/2324-77-0x0000000000400000-0x000000000057E000-memory.dmp

        Filesize

        1.5MB

      • memory/2324-78-0x0000000000230000-0x0000000000231000-memory.dmp

        Filesize

        4KB

      • memory/2324-1-0x0000000000230000-0x0000000000231000-memory.dmp

        Filesize

        4KB

      • memory/2324-106-0x0000000000400000-0x000000000057E000-memory.dmp

        Filesize

        1.5MB

      • memory/2324-107-0x0000000000400000-0x000000000057E000-memory.dmp

        Filesize

        1.5MB