Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2024, 23:01

General

  • Target

    cmd_fw_installer_138430009_eb.exe

  • Size

    5.4MB

  • MD5

    b48216dca6f745a40645248384659fdd

  • SHA1

    3bc265e7282bfb5c63be6cc73a2b7aad9a060904

  • SHA256

    9b6394b0d1da147c5c718ebf3aba211ce2d4aefc63eb0dc80ed5cfc0db269bcd

  • SHA512

    488fbd2b606c4f829b0ec05217b7d9be687cb885b988bc7cdcf7e1d61da2ef06fc422646696e24c2a1c1a63d793bda2293204037bd5a0178a673c00e91b226ec

  • SSDEEP

    98304:n3oeoi7dSeyJ6A89FbeCD25kvriejkx9sZjMK6vx6IF/M8aWzBWcPNkNzt9e:n3oeoYSeyJ6vnKCD25kvmeh6vFF//aFU

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks for any installed AV software in registry 1 TTPs 36 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cmd_fw_installer_138430009_eb.exe
    "C:\Users\Admin\AppData\Local\Temp\cmd_fw_installer_138430009_eb.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe" -log -setupname "cmd_fw_installer_138430009_eb.exe" -sfx "C:\Users\Admin\AppData\Local\Temp" -theme lycia -type web -mode cfwfree
      2⤵
      • Checks for any installed AV software in registry
      • Enumerates connected drives
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall_138430009_eb.exe
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall_138430009_eb.exe" -log -theme "lycia" -setupname "cmd_fw_installer_138430009_eb.exe" -type "web" -mode "cfwfree" -sfx "C:\Users\Admin\AppData\Local\Temp" -logfile "C:\Users\Admin\AppData\Local\Temp\\cmdinstall.exe_24-02-22_23.02.26.log" -parent 2660 "Admin" 1136
        3⤵
        • Checks for any installed AV software in registry
        • Enumerates connected drives
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Comodo Downloader\cis\download\installs\8050\installer_data\binaries\files_info.dat

    Filesize

    34KB

    MD5

    f42c56a1f750bdf43155a2aee0f1407c

    SHA1

    0929dd9594fccffe5e7e43ea33a5eb6467afab0b

    SHA256

    86e8a71d1327fe5f26901c8a7d10bac322dce1ff621e1339db9c7b6ab905244c

    SHA512

    31dc56d6455391a0075ab59d438335c9d38da43e1ef974bcdf14be059d63d48f8a8f7a1f6cd9eb5e790519a3824f59387abafef48417bbeb74e34b526646b8d9

  • C:\ProgramData\Comodo Downloader\cis\download\installs\installer_data\installer_init.xml.tmp

    Filesize

    20KB

    MD5

    06c0057d77fc4789b1428dd6710cd5ab

    SHA1

    660445d67f92e84ee9aa96a7aa6cd50ba43148ca

    SHA256

    e3a998c06b37cec5570409e0714af72a1a936759b4420adf1b0dfaf43bb7218e

    SHA512

    497a86bd35149465ef3ce3d7b483a3d4950475963a9cc20075f4f92a54b05fbffa97b537b256c9bcc31a3a20f4229d33ceed45f6bd30fc9057cf879bbb368a91

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007

    Filesize

    766B

    MD5

    2e5fa4187fb6415eecc96ad803ef7a1f

    SHA1

    68b78c4f61f4d520b33f57cafea093af55d908b7

    SHA256

    b062016459e7153d726d2c02b9cce214725a628a07750b54478e9ff30fe0e6c3

    SHA512

    bc01349a89f2ef26f38e9eb075eaf6a11c34a0fe52a493d3b24d1d79ce81e797e5588e5e67dc32efc73a6f3a173c7f6e05de25f39e28217744d0702ae0d91b13

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D11549FC90445E1CE90F96A21958A17_941A5BE5FAF3230B9FC294754AF2A1C3

    Filesize

    509B

    MD5

    fea8620759cc1b00f3bb49e396daf6ce

    SHA1

    1858314388b1a18502a21d96acf2461057512e0a

    SHA256

    d55895833630c4627a1a796bb8c276ec08ef9c385ccea58b5b6c77186602efa2

    SHA512

    33d7131b3a8f71c7c2f8defe2ac9f83f1b3e8cf64aa68109c3c991d4daa0941d5f1a15b929dcbf899d2f21448a6b5e4981f06eb7c149af1af8dc759f8c4d7532

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007

    Filesize

    484B

    MD5

    004b012f81369f0904188d00ff55a46d

    SHA1

    243296a84888fb39dee7c6992bfe3636df0cb970

    SHA256

    edb45099d01318e2464ee0e0b45ddfb07c0d8b7a667226c6b30b7cb8bc6d4963

    SHA512

    63fabe8abe2f0d601d5d668ccf3395e63e7ec02dc8758d32de7b22a6df9e157c00cc6f8691b559a6ed23144c0788fabda5f0054fc75263b65556122f1665f801

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D11549FC90445E1CE90F96A21958A17_941A5BE5FAF3230B9FC294754AF2A1C3

    Filesize

    490B

    MD5

    f5cc5a633c71dca6a726ec6f6e37beb9

    SHA1

    b920292a3bc3ed1dec967996e1ccc93eb9d81399

    SHA256

    19417d7490d2e28a458e5d00c805aeaea8169f4fdc25a093a54ecf4128d82e6c

    SHA512

    7823b26098b9818ffa3c3b92dfc6c2fb4a489eab036bba74c9e8de2339611774851ce91b59dee9cfc2d892a5f898a34408e4d88a250e0d7addff899383e4da1b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d52fb0f61424196805715e06a2ae3d2a

    SHA1

    262d27d1c4becb71929ec0c95c603481112e5be0

    SHA256

    d697d9d49e88ba58cd234972c4605f862f07ea65b8a5b3c1a8bd600def85dda6

    SHA512

    9a605c94809a8f60a63fffb156f00a7100877280b1af11b10af4508741b1eeff9c339200a8cd265bb3c1873ce8da0f02db17656691a997e3730dbdd17ee67aab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8a7082394aa13d0f4d9a1b097594d29d

    SHA1

    ec871a030e2597e3fe621e0d7a0889e3258fa73f

    SHA256

    9656585b835bcd8618c8a05870708b0cf05f3479a9b44b857a6c589a71ad6327

    SHA512

    79a35689a500bbf4a3418c4916124bb6cbaa275d3ecc2dbd6aeb66fa213743cb2a38e1bf85854c6f097bf477343ff67f693e33888f98af48a63dfb7ceb0b6689

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdhtml.dll

    Filesize

    1.7MB

    MD5

    f90177244159a1851797a61c6c2d086c

    SHA1

    c90ac646a58c828d8aad43f873311f72374b68a2

    SHA256

    c955ce483e494ce07fe4fd38e08a523729f9cb3e22f4ad29fdf040cbb1b693e6

    SHA512

    1c6f4fd6fd6cdc7c92cb745817b44196ad8638648c7fc7aec12a1607177bc7bf5d3529224ee05e628d0fac21e2496e61760c274138c884fe1ff1735359f1116f

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe

    Filesize

    3.4MB

    MD5

    0cbacd45075b383e88649045d1c8dbfe

    SHA1

    130b519d7375a5ad42a0201258451594ddc02acd

    SHA256

    1864547526db852f96d9b534240337f0696e1b8f4c449007227cc50321d2a807

    SHA512

    e94bdaf0436ca0080a6052c5054fe2f9b6aa57338a91932a2b89328e6832217d9c230fa594a20c6c0419c5645a2493817e6258307d77fe641547bff6429d74a9

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe

    Filesize

    192KB

    MD5

    e67b620c5a5deb3476de9e0237f73130

    SHA1

    2138fea56e5efc05662803375bd7853bee4bf037

    SHA256

    4d9b2c861874883974b49849374dd21c9248bdda27cc2a7584e9a3fbd9858963

    SHA512

    abbe1df643ac91a883f50d2ff13bc7bacbdb82be32549079811892a0f169b66acfc64c049710a9459f34ecdf7938937fb209c908e46e126ebe7f434b046df33d

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe

    Filesize

    105KB

    MD5

    f4d5edee6921a1e46f878c6add19bd66

    SHA1

    ba5e7cc4908b5dc6d8c9287141e11db2b0314a8d

    SHA256

    fcc2d8a8289f5ac2c22b9ee1ed428c35a824ee1180ce33ada601ccef9195b48d

    SHA512

    39db45e73ab01e12a3652d5c4b3ddd29245aff2a0d902ac7df296b1bf18f7d131c61790e1cc0eff51268439a819b07fa55b1bce67bffb7f13d43f73daac329f2

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall_138430009_eb.exe

    Filesize

    5.7MB

    MD5

    74cf93a3d559a630911fc94568b99e1e

    SHA1

    a5f164154e164174c715e493f440b1935ec53af8

    SHA256

    fe82eb2103b177370e742aee40a2b840805516ff23867f6b9bd3655a401eb50b

    SHA512

    c000d512e270d7f89058fe52a3ecfac6f60462eed21b134ebb57640cc6425e7ece9b6ce683acc666d8358875c8d621497a8e3eb95b4ad72311efb9d12c03100a

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdres.dll

    Filesize

    367KB

    MD5

    a4b3e07a9d407bca7a0ed76ea7c4945f

    SHA1

    af16d87110e2f9e64d5c35a6d522151b69377bbc

    SHA256

    b115a17e7500dbc34cce1f8e84a59f072a26ad49be5dcde6ac5908e4d2ad3555

    SHA512

    77c6ba298f5bd4c04192660d365d2a45ecb23fa441818735bd01050677037e1976670dcb457b6684343fbccb02a6fcfd98f22ae9f2de263057157917ee28d981

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer_langdata.bin

    Filesize

    5KB

    MD5

    b80eda6258e28b537651f8e5ebd997ff

    SHA1

    826741e138e8342f4bc3303838e347a44bb93546

    SHA256

    6e960dfed451c2dfb99352d25d3df8dd46fe7d80c9af79805c0cfbd1a99a2709

    SHA512

    9fce1cb5fe8b6a2bc4d13c1ca3ec31c926c6dd33717f145da6952ae33144eb11a6ee9e751e1d3e2d5d6ce7768e9f9602773a917d9f5f8473670e6d631b932b74

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\themes\ilycia.set

    Filesize

    764KB

    MD5

    7b85f91536c8342ac64d3edece2af7fe

    SHA1

    1e28c62364f606f03078e985222a2e3400a483c6

    SHA256

    918e7aad857776a895ecdf850665c355026882bcf1e0eba279ff4f7aa4b6bbae

    SHA512

    42cbaca95018eba8b05d3d586dbe8537ec1130af9edd813c4e7affef88c804a4ae65d9a446a95326508cd21da03a7e6a7969f6de5a68e69ce86c827f4308ac5a

  • C:\Users\Admin\AppData\Local\Temp\Cab9530.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar9552.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\cmdinstall.exe_24-02-22_23.02.26.log

    Filesize

    10KB

    MD5

    bf18e953106e63d544db964ab22afb19

    SHA1

    b1da8eb5dfb77064c5ae1e87a1054fc79d2137d8

    SHA256

    5cb8c0138e3b1e80f0c4403d93f568ee7b6447b9c55c4692e4afa3e2dc797eaf

    SHA512

    bcece36f565c12401185febcaff1aa99cad02c860695ee8dc15551a2848d6510c91617aed67f629861c7fbc260fb38287ee260c0511b2d000dc8af5220a60d3a

  • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.dll

    Filesize

    277KB

    MD5

    7baac18fb157c76574ca3d7a2f5eb193

    SHA1

    6460577ce621fa28133096073376f6a88f8acd61

    SHA256

    347144ae998d96c6b8664abf56f3ff8cfa4dcdfd6e13205d7e8ee2f3b77eefc2

    SHA512

    513cc213da81db470f8675c29162f4b724bb92a690edd451025eb68588971eebb937f88cc5a659222f2bbbd99440aa56800bf4167bb8912ea87a0b2648b002ea

  • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdhtml.dll

    Filesize

    4.2MB

    MD5

    6d9aa26bb18af69dc74ae8e822eb53dd

    SHA1

    6ef20da9b9e70afa742f047f1c6f9d3e58290450

    SHA256

    cf140523b8834de1c37efa29b02adcdc88babc0f8ee90ba93dd98c260d7036c3

    SHA512

    3a9e8f15d207e98bb182f8d1838e93dba9750e6cfc79b72aab0706f969866447e50b3ab28bc1768a7cac7e7733cde80085cabcefefae0d287f08374578935c36

  • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe

    Filesize

    640KB

    MD5

    93abd7a54285f664238b5e2a582ddf85

    SHA1

    0c530782df2d17180e43224433dd5cb919658eb4

    SHA256

    2bcf201b387b5c36f669e3442606d362f9792fd84ff4fed957256b9d2856179e

    SHA512

    fc41464652a16ed7b61461c4bfc80481b15539367c7ade0543ae0fa69eb4f90a764300dff49e8da93f9c44fea9eecc44a9a6014e41b00cc4df5bcaf6edf270ae

  • memory/1696-1798-0x00000000007A0000-0x00000000007A1000-memory.dmp

    Filesize

    4KB