Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2024, 02:23

General

  • Target

    69ba83fdc3bdef1eeb01835286651ef246968efd1d34c318afa0d3b6f8387923.exe

  • Size

    623KB

  • MD5

    69893879dfb7420cc301c2097d529607

  • SHA1

    f5d0929b50cb25555d6470946f76832a3f6fd13b

  • SHA256

    69ba83fdc3bdef1eeb01835286651ef246968efd1d34c318afa0d3b6f8387923

  • SHA512

    601665e12a529342586f0f85fe27682b20841a2c62c7ad0f2454d79ac3bc56c647e3f7d3147b3a33dc58b7e549c3e7efc42dbedf73cf5e8357421bc38e826398

  • SSDEEP

    12288:ylR3Rtp9Jt7SEgUceFLX2YRJpNpRyOArULAHW9O9k:Y3Rtp9JamphWALAGOO

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Users\Admin\AppData\Local\Temp\69ba83fdc3bdef1eeb01835286651ef246968efd1d34c318afa0d3b6f8387923.exe
      "C:\Users\Admin\AppData\Local\Temp\69ba83fdc3bdef1eeb01835286651ef246968efd1d34c318afa0d3b6f8387923.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -windowstyle hidden "$Gynecide=Get-Content 'C:\Users\Admin\AppData\Local\Epicoeliac\Malemutes\Nonprecedent.Fod';$Porbeagle=$Gynecide.SubString(53926,3);.$Porbeagle($Gynecide)"
        3⤵
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1616
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
          4⤵
            PID:2656
          • C:\Users\Admin\AppData\Local\Temp\Computerbaseredes.exe
            "C:\Users\Admin\AppData\Local\Temp\Computerbaseredes.exe"
            4⤵
            • Loads dropped DLL
            • Suspicious use of NtCreateThreadExHideFromDebugger
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:2388
      • C:\Windows\SysWOW64\mstsc.exe
        "C:\Windows\SysWOW64\mstsc.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:2588

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Epicoeliac\Malemutes\Hernias.Aut

      Filesize

      326KB

      MD5

      77268bb2b770c8b4aa6add0774e02577

      SHA1

      5f58fffeae17ebbd08c301ecefc7371732343117

      SHA256

      4329ef95e4dfbaf5766b6068ded0a1e3d694fa8cdba5e65a02be6e3a63dfd455

      SHA512

      fd919425f4cfd5fb11817aad8dc45a572f7c0c32a3e3d5ca8338cf8667e47a12e6e9d14bf3fc174e237b0a7bacb172cad91ac92da992a49b48628f8e9e4e2d91

    • C:\Users\Admin\AppData\Local\Epicoeliac\Malemutes\Nonprecedent.Fod

      Filesize

      52KB

      MD5

      d70cc7a86c607e5511048fe2b3242bf9

      SHA1

      7533500bfb680dc5fcea3e37fd2eca0385990376

      SHA256

      9be2c4093ac767d9ec1aa035a7a8139fac9347068f303e1ef583b4d1f8dedd2b

      SHA512

      05052e82d38f94ff7eb6ed89a7fd9041c20d03eba7d6d193c3fe85c628605c70fa8cb2dbb1e44ee721c8143bbcb6e5caf72c24acb134628d967e757b18d158ff

    • \Users\Admin\AppData\Local\Temp\Computerbaseredes.exe

      Filesize

      623KB

      MD5

      69893879dfb7420cc301c2097d529607

      SHA1

      f5d0929b50cb25555d6470946f76832a3f6fd13b

      SHA256

      69ba83fdc3bdef1eeb01835286651ef246968efd1d34c318afa0d3b6f8387923

      SHA512

      601665e12a529342586f0f85fe27682b20841a2c62c7ad0f2454d79ac3bc56c647e3f7d3147b3a33dc58b7e549c3e7efc42dbedf73cf5e8357421bc38e826398

    • memory/1616-23-0x0000000005270000-0x0000000005274000-memory.dmp

      Filesize

      16KB

    • memory/1616-17-0x0000000002640000-0x0000000002680000-memory.dmp

      Filesize

      256KB

    • memory/1616-20-0x0000000002640000-0x0000000002680000-memory.dmp

      Filesize

      256KB

    • memory/1616-21-0x0000000005E70000-0x0000000005F70000-memory.dmp

      Filesize

      1024KB

    • memory/1616-16-0x0000000002640000-0x0000000002680000-memory.dmp

      Filesize

      256KB

    • memory/1616-14-0x0000000074120000-0x00000000746CB000-memory.dmp

      Filesize

      5.7MB

    • memory/1616-24-0x0000000074120000-0x00000000746CB000-memory.dmp

      Filesize

      5.7MB

    • memory/1616-25-0x0000000002640000-0x0000000002680000-memory.dmp

      Filesize

      256KB

    • memory/1616-26-0x0000000006210000-0x0000000009EFD000-memory.dmp

      Filesize

      60.9MB

    • memory/1616-28-0x0000000005E70000-0x0000000005F70000-memory.dmp

      Filesize

      1024KB

    • memory/1616-15-0x0000000074120000-0x00000000746CB000-memory.dmp

      Filesize

      5.7MB

    • memory/1616-32-0x0000000077830000-0x00000000779D9000-memory.dmp

      Filesize

      1.7MB

    • memory/1616-33-0x0000000077A20000-0x0000000077AF6000-memory.dmp

      Filesize

      856KB

    • memory/2388-37-0x0000000077A56000-0x0000000077A57000-memory.dmp

      Filesize

      4KB

    • memory/2388-66-0x0000000000400000-0x0000000001462000-memory.dmp

      Filesize

      16.4MB

    • memory/2388-35-0x0000000000400000-0x0000000001462000-memory.dmp

      Filesize

      16.4MB

    • memory/2388-38-0x0000000077A20000-0x0000000077AF6000-memory.dmp

      Filesize

      856KB

    • memory/2388-39-0x0000000000400000-0x0000000001462000-memory.dmp

      Filesize

      16.4MB

    • memory/2388-62-0x0000000000400000-0x0000000001462000-memory.dmp

      Filesize

      16.4MB

    • memory/2388-63-0x0000000000400000-0x0000000001462000-memory.dmp

      Filesize

      16.4MB

    • memory/2388-64-0x0000000000400000-0x0000000001462000-memory.dmp

      Filesize

      16.4MB

    • memory/2388-65-0x0000000020FE0000-0x00000000212E3000-memory.dmp

      Filesize

      3.0MB

    • memory/2388-36-0x0000000077830000-0x00000000779D9000-memory.dmp

      Filesize

      1.7MB

    • memory/2388-72-0x0000000000400000-0x0000000001462000-memory.dmp

      Filesize

      16.4MB

    • memory/2388-73-0x00000000000C0000-0x00000000000DB000-memory.dmp

      Filesize

      108KB

    • memory/2388-74-0x0000000000400000-0x0000000001462000-memory.dmp

      Filesize

      16.4MB

    • memory/2388-78-0x0000000000400000-0x0000000001462000-memory.dmp

      Filesize

      16.4MB

    • memory/2588-77-0x0000000000080000-0x00000000000C0000-memory.dmp

      Filesize

      256KB

    • memory/2588-80-0x00000000020C0000-0x00000000023C3000-memory.dmp

      Filesize

      3.0MB

    • memory/2588-82-0x0000000000080000-0x00000000000C0000-memory.dmp

      Filesize

      256KB

    • memory/2588-83-0x0000000001F30000-0x0000000001FCA000-memory.dmp

      Filesize

      616KB

    • memory/2588-85-0x0000000000080000-0x00000000000C0000-memory.dmp

      Filesize

      256KB

    • memory/2588-86-0x0000000001F30000-0x0000000001FCA000-memory.dmp

      Filesize

      616KB