Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2024, 04:36

General

  • Target

    9ac49679720474f3fa68f27b9010f224.exe

  • Size

    147KB

  • MD5

    9ac49679720474f3fa68f27b9010f224

  • SHA1

    8e179bd3986a11157270a009e2fc677422b451c0

  • SHA256

    e88ebfe8ac396c0497f4721035a223db4d50132e2f2d2e83ca5893c35d095341

  • SHA512

    81a6a8c990679669fcd363a6f2c368a4c0c92596fd17dd7e4a6c568fa54e9a7f52f1c3627e78513ef93a33a2c57714f56cf125ac90da88072b816ea48296ade7

  • SSDEEP

    3072:GPQt3aMxzd3o9fUPHC56IXsLkce6p23CskJXljt/wOl2RkOIEY:GPhaCEHpMGljt/RYkB

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ac49679720474f3fa68f27b9010f224.exe
    "C:\Users\Admin\AppData\Local\Temp\9ac49679720474f3fa68f27b9010f224.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bt0867.bat
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Windows\SysWOW64\regedit.exe
        C:\Windows\regedit.exe /s C:\Users\Admin\AppData\Local\Temp\323.reg
        3⤵
        • Sets service image path in registry
        • Runs .reg file with regedit
        PID:2604
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
          PID:2868
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\system32\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run" /v "Windows Genuine Advantage" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\wgatray.exe"
          3⤵
          • Adds policy Run key to start application
          PID:3048
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo y"
          3⤵
            PID:2756
          • C:\Windows\SysWOW64\reg.exe
            C:\Windows\system32\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 0x00000001 /f
            3⤵
              PID:2356
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" "http://ver.lovezinho.com"
              3⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2592
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:275457 /prefetch:2
                4⤵
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2196
            • C:\Windows\SysWOW64\PING.EXE
              C:\Windows\system32\ping.exe www.google.com -n 1 -l 1
              3⤵
              • Runs ping.exe
              PID:2640
            • C:\Windows\SysWOW64\find.exe
              find "TTL"
              3⤵
                PID:2284
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Version Vector" /v IE
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2836
                • C:\Windows\SysWOW64\reg.exe
                  reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Version Vector" /v IE
                  4⤵
                    PID:2576

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              b7ffb3c865db224e032ab2497460c5a2

              SHA1

              a89bd082ab5f42815535be2f213c39867e2a6951

              SHA256

              cb185bafdcfb5a8eb3b8bf40432879f76dfe6bf10fa800c6504b390a1981c80e

              SHA512

              d323a2d579d4624b888771d31b7f6f94517ec0f750314bbb745523ff3ee0056d157436998c032d22bb88e9e946fafbd70e1746e84de7c3f9acbc9da4d6fa65f5

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              6c69e19992dc2255c97439aa514c2d96

              SHA1

              03c39c6c561f40d4eeb0c4f375bef24ba23227fd

              SHA256

              6f91cec6f72592e5590e238e88660bf9b86263ce7bae1389d8a79ff776185fa6

              SHA512

              34be3ad67847142c219f8d196d5b9b4bb2d560d754624aea32339385595b9177d8d0f7bbfcfb34ed13313d1eda043270eb94f2a5c8ad52d598687c54fbae8b30

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              58210b7a4f6d3cdf30e74cdf7cd67989

              SHA1

              76b8ec1119198d6166bcaac3b3d72f1957665db1

              SHA256

              9c6a9b24c332436b926b7fc6a5d218427251a6533c6b0964049971046a894363

              SHA512

              441b8aab0d458230cb38d0d0076efbc7b848c1223e3c88c1cd93bb1a95062233ee9e72453aee426ee6bac380095bffc9db572fccf67ca5303780fcb5e9d6d3aa

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              8dd4e9a807056dbbe407b0087ae7ca48

              SHA1

              a1ef22083d4d5ce3db5b7f6248dc1fa275fb84a4

              SHA256

              55d33cda22c39f8c047120f8389a77e76433d84f46c84f6c7fa00ecc77590a40

              SHA512

              3b8622d068a6756a82e0121794a2c2898c548a8b48acfab4f9beca3e5c5ddb0f0cc492b85704553f4c826540da36b6a6b16f87a5cd03466efda5833541791c37

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              a5b2954739adf99f49aaa43c6e951f2f

              SHA1

              bec7004b2d4d4f0bedb89bb0912ee49c40d6600f

              SHA256

              580387a9f3d71155a8280d3002c7ec5e8824b5b02be934fc41b08bec6fc96703

              SHA512

              4e0290da02a7e18f9413dd0d273f76cd74c62b7d9c457fc214749e0b617848c6b7d0e4cea6986ef217b01600368740751a32af596555242688fa5219069785ab

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              7c4c2beb2a77abcb46b375802d1469f4

              SHA1

              95a69581833d87c571855978206dede17933a403

              SHA256

              8f31160479659d0b25ea091f44455a08ea1321b4842361974d1493a4be69cd49

              SHA512

              dbe6b67fbf105116ece00333600633c350d604f620784fc009c8ccf47fad5da8cf8b9c72d534a7f0744f5bcb528af7fcccddc7505e483595563fa6984c53cc02

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              34c827699df97ba5145e2803ca7e1ffa

              SHA1

              41928e1fa0b03871968b725f7f98a2922410d070

              SHA256

              21cfb93a0752b3c123a24df688bd92addaa38d1206a987ab616119159cc3829d

              SHA512

              5cad44efa729a5b6cfa92a0ad1df07fda9b93946f02a1f0672e5cbf70292e98ffef2afd1202a4fb05a1d06e58285f3fc43b2b30a64e4516b74e71ed4728094e6

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              d8f2c7a8d7313b7ff7c558ea073ef8b5

              SHA1

              2d2b84a3e663b8390d1b92c6d89ad92c3e4c3834

              SHA256

              c803550c876ce886f6d4391dd5855c07e84f1345fd38a2dc258ff6f4552cb2bf

              SHA512

              4063c5fb224fd528fdf885f57787b3a924aca72f451465939605727429ddb1d0b32a6feb898b0f1828c022bcb4195ce2f867c20273ded400d63fe876c389526d

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              916aae8bb5fcd1021275ab9e10c12cca

              SHA1

              0d8226ab1310d443ce0fde2bddb02c3af68d2a29

              SHA256

              fecf9cc70755be49de3336b4718f251b120c7e7ddca7f9dd0f21d01022818799

              SHA512

              1a425d0c40c9d59dbf0bab1ad83c06a503a71e1c8ceffddcdc34d10964ebd6fa850a992deee88ccdbdfb3f705c0dd81b005971684725d40dea2f71820bd281da

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              657e302c29a1ed491af5b9994b1f1384

              SHA1

              ea6720c5f7a37cb41d375502e0946dba06934e32

              SHA256

              d268d1f3dc84629ed0e56a082e9783230d79768ec3ede9c81a19fc112ccfd8e6

              SHA512

              152e8b6d56e0e186fcbbfa00384b46812955f8fed28ba0251fc15b1276b1066921a8a5e6d2756fb04a6a09d4105f0d8b4ebf031e6f4461e9d5ad808964f2ced1

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              9025bf34f4d399b4153e54d1da3c4cf9

              SHA1

              6a5e8b82da062e495245610e7be84af05e35cf59

              SHA256

              4d4b88e209490153a5832c883ed4854b794917b3e5fdb38c418e756a06e6c27d

              SHA512

              68731c47fb829c44a4aced4f1f0dfcb000c4d9c8bc20440efbb3d3cfe5c4dc4303b691cde86635db4750b72ad80b2432c19ea3a104cdd2a046ba0ad92e667163

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              3bce85dd11600ab5f47d6d8d33b8ffe1

              SHA1

              a99112572cfeafd0f8544b6844f24a80040258b2

              SHA256

              69bb564e9002832711e1a82acf1ff8dc7f60a519811994fe58ea3bb4484ccd0b

              SHA512

              3899a0741f32b790a71bdb3aaad5ff636ac7c17744b8f53a3f50795f84ba5ea6322f4c1de07880f305da71883c6bfc72f8b05e2e6675be496454eab76c3fb534

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              1adc7bfa71f4603546b76669b315d9a3

              SHA1

              1353fd9efebdbdae46d823eeab94ae2755552058

              SHA256

              8886c996574e0339c5978dfc20ead7be95002a2982bc0808990ecf0393d03bca

              SHA512

              fcc9666c4711a31d5db77c8d6f87350c42ef6438f39de78e3566ec31842f86ff468d0f7673a9d11e319de0aef0d656bb97ac1c2ca6bdfa688ddfc3a2e5e121a7

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              ae041c571503ffbd4b8dd4519d5c7ad8

              SHA1

              635dd87918549a5be526f541db328b5bf6bc0ba5

              SHA256

              3a515322829c16628ab0212195c6473d64d2462f9464771243d8d1a6b91b4947

              SHA512

              05e1e74260de0fee4c7fb2376232ba64e273e42a4ea2e502ff98474fbe49ffa9addf6a1ebad6b60d7419efe2a96ee188054bd3cc640672ec1be295ad08ccf76b

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              5c6a640d6ac4b47fc970534073d05084

              SHA1

              d81b0f62430734072ad211cafc8661a7f3766004

              SHA256

              28e17fdfa6ef56d043c79f26746da92dd551be9f50fb216b60b96411482f21a2

              SHA512

              06f115a1327e74de35f74f1328308f0ffe13feb2d155467cd9181b6a22b70ee25461d82d3c522c5127889c94a4c6c0685fb69859526e8b227a418e322d34d949

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              465023f1a5ea48821f8bd596eee945cd

              SHA1

              2a920baa00a44939298dcc2d46ce90c987f26c54

              SHA256

              8547d2359d2c375a52055355677d48e7e3695f6b1ae3e1b0322d1c0eabd7f3d6

              SHA512

              11e55f6953dfe778a145bb3def57b70f346015bfa490d005cb435101a95d053ed6b9ffcadda680b0b5d7a90a57c50e0bd14fc779f1e8d82e3e9733124e693ebe

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              40d57ec59efbbbebdf9eb0eb05882ad3

              SHA1

              eb1d6aea4bdf8ec6c908f651d8426523c91bb55b

              SHA256

              476227456c865215d029a703649e9aee30c56a0a2420e624b2180af3426a4ce2

              SHA512

              c794c4fa3a807e14ac2abe701c1c92c6727744904f54ae6c0153b09d027650bbf6586e409e31a43c140194cf8fa4d0203b071709ecc8f0354ecb17e2207cce0f

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              b5d87c87838fb9dd387bff1e55a01bd3

              SHA1

              3b29cbe86549354d775a963e4e4257afe3dd53c6

              SHA256

              7e5501b944f95995785adbecb4d692940607f33322d92c1ce5559103e87b90a3

              SHA512

              44c8277774334b2c7c31217c6d4c675b19663afbfc5b65ac7c7a7a7d3659c294a3b594456990ff6b68b24aba72effa774bd300643bd17acd38fd8747bbf37e78

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              d76e4f3768c20cde73ce9d23a453748c

              SHA1

              eb7aabd5ba7b05cea3828cc1a5fdf17737e01dd1

              SHA256

              55f56e13e814bcb1ed624ffa849b541ca3d82713a5379b30e5ba18721703054c

              SHA512

              66bbc94a58ae472d279de8654a4abd8f379c6f1e4e58d4591e3edeb6c7d8fc0176171eee106d5a151ce7fa58852291b0a6859607ea56eb683493d3a9f4a6b7a3

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              344B

              MD5

              f2cb3c2f43ea668777a813234073b18a

              SHA1

              c05118a83d7ec2c12ae62228e2657f2310723a32

              SHA256

              e0f3c1c8e7705af6403011cadba7d32a665dec179f513d6628ba1d254a2a10fe

              SHA512

              ec94c8a1d7fc429f13dc0e73e0158383e8107a64bf6475a4d0dbbb7e0f5209161b937aa3ac6976af33956937f94b02960afd4cf8976eb0a317327dd04bc669b7

            • C:\Users\Admin\AppData\Local\Temp\323.reg

              Filesize

              1KB

              MD5

              10bc201c5d51010650443adc933e4166

              SHA1

              71676b93cf04961657e50fc1fe4bc20ee5ea6079

              SHA256

              9c67e59028ac82abc17381b92c143b3c4b4395c5b8ce80b4a9081139f5931af0

              SHA512

              b3f8b307805922f19aca687b3355c06cdb029615cb89ad6b1a6144dd0c364f2cc418ed95a94fdd741d51b4cc1bb4b75971756fffe2f87d26ae5e5e1d87dd8b9d

            • C:\Users\Admin\AppData\Local\Temp\Cab4D87.tmp

              Filesize

              65KB

              MD5

              ac05d27423a85adc1622c714f2cb6184

              SHA1

              b0fe2b1abddb97837ea0195be70ab2ff14d43198

              SHA256

              c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

              SHA512

              6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

            • C:\Users\Admin\AppData\Local\Temp\Tar4DF7.tmp

              Filesize

              171KB

              MD5

              9c0c641c06238516f27941aa1166d427

              SHA1

              64cd549fb8cf014fcd9312aa7a5b023847b6c977

              SHA256

              4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

              SHA512

              936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

            • C:\Users\Admin\AppData\Local\Temp\bt0867.bat

              Filesize

              6KB

              MD5

              8147cbd0ddf1c7b8df78b7bcddd1c856

              SHA1

              91eb0f3b4e99e11d07271c34e5dbfccd0801c4a4

              SHA256

              9c691aad1fff084cf2b9b2fd2cb21cba238364f2f1352cbf141e5f53ccca1ce8

              SHA512

              827e1f75308f8a231cbad9481a527585125bc3f64760a56ed2648eef2c7fcd230c09472265f2aeffa3a0012aec29354c38d7d5e67bc4c5dbda1c5694c2987094

            • memory/2572-59-0x0000000000400000-0x000000000042C000-memory.dmp

              Filesize

              176KB