Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2024, 09:29

General

  • Target

    9b51a5efe3ee8ab6d2ce19e4e56d0357.exe

  • Size

    211KB

  • MD5

    9b51a5efe3ee8ab6d2ce19e4e56d0357

  • SHA1

    35d876a14a3a8f7a15e4f39a7cbbce6b1f35078f

  • SHA256

    744c68306b42089e9aa6521db82dbafca142d642b8c7eb0c9b6747bf68d0b8d3

  • SHA512

    9458551ccd0c57f3de817e8132fc30f0325080a44d2c8eed9065f14419957868a3016f628629e3f81ec6978880a4b9b4399647e45c9611518fec45fcf66d3f31

  • SSDEEP

    3072:0GwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:0G/iVkO20SFgBhxtW9mG9+Umt3Ezjb

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b51a5efe3ee8ab6d2ce19e4e56d0357.exe
    "C:\Users\Admin\AppData\Local\Temp\9b51a5efe3ee8ab6d2ce19e4e56d0357.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      PID:2644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    311b3a48769fe769e4df1478fa9c69de

    SHA1

    cb47f47f7c08ff73667e1fbc489da4ea2fbfe5a9

    SHA256

    ee896fd77db27c7672cf09c752ecf2f08665aeda003be77ec125747b2cf0b425

    SHA512

    9513067c2d1d3f8b8b7ad3f7b219882ad7dbfdea40427e3c0aedb15c54860a2d238f67c9f11925fb831148aacbe29ae12c84905943e203bf0f1bb755317be87a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    77aa145331ac725228ea91de2adb38eb

    SHA1

    641221d6e3c96f3e287f52776f0566cd1d9fe5ce

    SHA256

    8382aff5d40abd84dc3026de1f09aa95f65529b621ac472e12b749d9975c1534

    SHA512

    90fa33f6b48878e211255f8d4a14075c9b149d0a6dce82d93333e80dfbd20440e33db32f199fba5aac91d85c49f1a04d241ac6a31023bf15c62f93d24974165a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f2063fcc4de03c28240a3a530f78f7d8

    SHA1

    2a46253934c53d44b15a81bf48d1ab00b1234e10

    SHA256

    7b7204847279b5d071ec5b7c444476d264184c59d8a571cd5185fb4ce8bbad28

    SHA512

    e6895b05af545d20a1c4705adad65b505ffa5824410a88c55af1d1bd380c4245d50067c4a849ed3a06eaab969704e96df975c0e17b61bc4d15a6224eaa03d3bf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d1ed916bd27c4bf508ac32224ecee03c

    SHA1

    329316ec3dc63ac8a952895d6e2b62c8017fdc35

    SHA256

    b78e9f04841e61b22997b87b12f298e9971aec3ee14d03c8b54336be8fd44c85

    SHA512

    059f6d62dfcfaddc2b2a75505cf1c6c8c40c69b82ccf8f98bd0b2c6657ed069deb3d1cafc5dcf1fd6bed5af0eeadaf2cb166a4ba5dd5eed7aceeeca80fba61eb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ca1fdd738bf81b3c021a3223c81d0b69

    SHA1

    250eae39fc567acbdb8572269e1131d7febe0f30

    SHA256

    a3ad71254c67c3468be53bb0b462876b7a7a34f2f2860b8c556d024d8012784e

    SHA512

    690621b6d45fddb02a9dfe5cf8432aa3d20d2537113c04e00ad02ae32efaeb752c8db889f31fef884931dad7da695ce9d25e2b4bc3261ff6f3b1bb7f20b891ab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b16f38b657997b54b5c461a724662d36

    SHA1

    c46139c959771d6cf0d56047668fbd5c73607a0c

    SHA256

    403c376621c8b46723404e62fec6c6bcb4ca1e4d3447a44d2912e9dc36a50693

    SHA512

    58fc4eea98c3db249c9160877326ddb5d82abafd4bb99c046900eae06b7af63320e151cacf3d043fd043689a58ab84d2d9eb75dbc6c40db8bcecaaf3d9ffad5a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c3bbf28a07da3f82484ba6c11d190645

    SHA1

    8568549e6e4455dbb460916f5eece195804f0ba5

    SHA256

    70b74f7cef88367a5f8677523178dcd4b9b2b348707f4b3d0839c6ad08b4f4dc

    SHA512

    d98ef4c915fa8876ba85468f4518dc93438762ae72d17f67851bd6dba210c59da11f95417810cbc70e67ea5f2f42456c80df4c018cfcfd5afb62dee9915fd471

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4df7b321233f1962259a6cf36dd99d50

    SHA1

    b2c851f01e1095da97debe99ef85554dd8fba3a0

    SHA256

    9a25494340cb24e99cf06a3499311a4af6f82282aba0d1d7bfefd6e9daed1da4

    SHA512

    1435e154523e427346c1d9e4c5178e9c8a50e09086ae2e106611d88234dab67245f92a6b0d5b185e9e6418f88161e7255af8344044b8ba150d66917ebf6e5ee7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    54027d56f60e78d2cee2fdd60d575c84

    SHA1

    92185c720ae0f5202ccd121d442b04ebf2dbf0ed

    SHA256

    75bd27d76dd2e01375fc4b54f5c3855305b88fa7975ecf2a7ffcd5f3459ef79d

    SHA512

    c0300dbe7bf26052144b4a902177cc141f36a74c60b899bc6b8ec5f8fe928e413361cd3ba239a130ea2a671ffdbbf565b21a265836733a7e5bdb85db10e03e96

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    e8be88f09a0c96d24de20342caf3d769

    SHA1

    8922bdfa293e86f22c232f42e9ca0a7ee76e4d82

    SHA256

    5d5f89b809c4ee8bafd8c71174c736c90eefbab80495aaf2db329f94bc545150

    SHA512

    bd293f4feaae864246eca5015712ef5dedc13739eefa7d34d3469739f6d776b773d8b14f3ddd19989273ff49a6fd20d582e47d63f199cbd1c0596278980b9073

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\login[5].htm

    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\login[4].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Temp\2BFA.tmp

    Filesize

    2KB

    MD5

    5abe4e1ad66427e7376918185f9e16f8

    SHA1

    56973a32eddda27dc726904edf28b64bf095da3d

    SHA256

    2724bd9480d881a7dd61b9adeb9e5ca07e17f63dc699ad4afb12946aef723172

    SHA512

    776974bc38265bdbc6a260815ba5aefd83945dc617379feb10c5b69614b53020b8b0480cc782fd51f3547626e23238dc4737813fba54aa34bca4de6daadac5cf

  • C:\Users\Admin\AppData\Local\Temp\3EB2.tmp

    Filesize

    2KB

    MD5

    23ddb4349813ae042def5221b60adee6

    SHA1

    64f93848ce461468f898868767030b9360502134

    SHA256

    428a42cbd811ff0844eb33dcc9c0a413a9e4d62b668af37ff58f93748ffe792d

    SHA512

    16773734ed63dfc7f6790615ee96b7ea963bc62e0f9be746ef04c111949356af52b3d0473b39d4fdb11abc32c7c72ce0c5954e25c2b0f35cf83ff9dc7aee0eca

  • C:\Users\Admin\AppData\Local\Temp\CF61.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\CabB0D8.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\D32C.tmp

    Filesize

    2KB

    MD5

    a8fdd0012e6998420474a0c0669327c4

    SHA1

    aa0b687e766c259a247c16677f4c631ce542fc6e

    SHA256

    85a0119ffb919c7b1157dabbc8e40897f97ce6544f89931e503564966057d5d6

    SHA512

    bd834b7119f51ef0c741d2c0696e449e13a003140ad631f5e272130cac2d30f8cb25a5e76cc415ddf6208ee920efed6c7c33519b8f1bd02dd4ae8d3f39e926f5

  • C:\Users\Admin\AppData\Local\Temp\E747.tmp

    Filesize

    42KB

    MD5

    a3fb137f1061169469e78f38cf73d50f

    SHA1

    53532402ad6731a7de928c8b2817abeaabea01de

    SHA256

    dba8dad919658f8aea9104ca10a1b8de207b0acc98bab1c9db5a1e238cee0480

    SHA512

    3a993a94969f5e8934593c17dd00833e507610c87723ef872467197c1d9776e980f5d083ba52c65e2c32ed3e6bf2b5dbd18a015ecf4b6aea8ad7e8e253d98781

  • C:\Users\Admin\AppData\Local\Temp\E757.tmp

    Filesize

    481B

    MD5

    564afc012c43c2b507df03f94394be6f

    SHA1

    abe15a2cb6e92a4d4956acbad0185a01c7050300

    SHA256

    3640771ec44af4c925c4e591ff5af4704bfec1c6b432ab4ca09380607169fbc8

    SHA512

    a76b0e58b7b7b9da5c81a09ff5c617b94c34e0c4ed3b5060b9352c31a994150e7a4533a6091f6b033248eb29b34192981fdd238c5365a464299e51a9665d2bcb

  • C:\Users\Admin\AppData\Local\Temp\TarB2DD.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • \Windows\AppPatch\svchost.exe

    Filesize

    211KB

    MD5

    651dbd3c4928cb75c107fe85d3b5d70b

    SHA1

    0245559a397de30ff9ded816bc248a404b01bc40

    SHA256

    0ecfcee005967905c4ab5ff5f1a8045b8b8f49bbf0899c5a67f762b4fbee308a

    SHA512

    7db0c4b1ee1ff6f963000a2f635764eb4588c37edc93829deb59f56e9c002417b8a63d7d927bc4465c65a78ac92eda7b461997a9b80c516b2d153d5752e6136b

  • memory/1444-0-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/1444-18-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/1444-16-0x0000000000320000-0x0000000000371000-memory.dmp

    Filesize

    324KB

  • memory/1444-2-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/1444-1-0x0000000000320000-0x0000000000371000-memory.dmp

    Filesize

    324KB

  • memory/2644-62-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-76-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-49-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-50-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-51-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-53-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-52-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-55-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-56-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-54-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-57-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-59-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-61-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-48-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-63-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-64-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-65-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-66-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-67-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-68-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-69-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-70-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-71-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-72-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-73-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-74-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-75-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-47-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-77-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-83-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-85-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-86-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-207-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2644-208-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-46-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-45-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-44-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-42-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-43-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-41-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-40-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-39-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-38-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-36-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-34-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-32-0x00000000027A0000-0x0000000002856000-memory.dmp

    Filesize

    728KB

  • memory/2644-31-0x0000000002490000-0x0000000002538000-memory.dmp

    Filesize

    672KB

  • memory/2644-29-0x0000000002490000-0x0000000002538000-memory.dmp

    Filesize

    672KB

  • memory/2644-27-0x0000000002490000-0x0000000002538000-memory.dmp

    Filesize

    672KB

  • memory/2644-25-0x0000000002490000-0x0000000002538000-memory.dmp

    Filesize

    672KB

  • memory/2644-23-0x0000000002490000-0x0000000002538000-memory.dmp

    Filesize

    672KB

  • memory/2644-20-0x0000000002490000-0x0000000002538000-memory.dmp

    Filesize

    672KB

  • memory/2644-21-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB

  • memory/2644-19-0x0000000000300000-0x0000000000351000-memory.dmp

    Filesize

    324KB

  • memory/2644-17-0x0000000000400000-0x00000000005B8000-memory.dmp

    Filesize

    1.7MB