Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/03/2024, 16:52

General

  • Target

    b93127274edde80050d425d8306ef03e.exe

  • Size

    2.4MB

  • MD5

    b93127274edde80050d425d8306ef03e

  • SHA1

    404d8306b2a391bf744490d993ac6059144da2c6

  • SHA256

    cb875bdb6314c7e7edefa075640162eb99cf088f72fe18a18584761c092efad8

  • SHA512

    d9ba993be85d0d08b7a719ce955498a1ae9c27cfb5d595fc689507d9832b049a78970cbda810093786e9ce3348e9809e1d59335d009ab02061f965c7d1105f1c

  • SSDEEP

    49152:Tj9EMp9bpMd3nHHGg1rKlmAYkGtUx7lBhKCn+tYjd2lP+6+o:TK9rsrYjY7lD3+tUd2l2

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b93127274edde80050d425d8306ef03e.exe
    "C:\Users\Admin\AppData\Local\Temp\b93127274edde80050d425d8306ef03e.exe"
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2828
      • C:\Windows\SysWOW64\reg.exe
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • UAC bypass
        • Modifies registry key
        PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    efef8e14c4639024eb661b400c7beff7

    SHA1

    031ee1874f7e74ed0998f4e89206a4aa29f0c142

    SHA256

    c5a6b7e4892b55412a03a541c7483be3a92118d06679453efd24cc7ac56af427

    SHA512

    1d8254f870a4125533874da85390c05adc184d257a078179812a7dcac55365dccdb6194d66a62a7c2ee3e741ebc865a1584b3f6513fe89ebd47e76f548d6bce0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    172006d5e4e6e3603bce26dac6c9eef5

    SHA1

    9369ace8aeb4f8a3a6435fb744883fb9e347209f

    SHA256

    cc48b3470558be960aacac5623edbca32c1891deab27fdc5bbc4eb81aff74c4b

    SHA512

    1c5d29d2542d23bb26165ff82d3eea0af3b2873ec104ffa69022048ae83224a05fc5d8d19f03d4942979f74e8135fe734eb268337da1366a243c260244c98928

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d04bc7efb922688c38d8023a16a24299

    SHA1

    35c2018a16c4efae5916654cc5b288042eee0199

    SHA256

    d6024f22b5290ce3e5fd2bd4a42791fbb6ffd7562f064b22d11bbce36a05861f

    SHA512

    b9cc829a78338272222aaac6e60c4628193cfbebcd8a11aa831476ddcf2ecf86a37315bc1e12cfb2f98934ab45fad6be8bebca91e1a8895f5229823a0b03f855

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    51f53ab867c5ac7d5e56064e55fce8f8

    SHA1

    da08830a10fdde7b5445e12be9669b1df9834fb7

    SHA256

    9278bf2fa836c747a9c472e9f8dfac6e69b96f399caee7bac50c552e0a5014e4

    SHA512

    30b75975046ae0654c8f97df3dc34043f814987ca41718c8e95b643dc1f6af85eced2d3771d52192b77d9579771b5e95907d0bac73d47327d8d8453304881f6e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9c6f1b66c7da1ee6a2b142440c3be552

    SHA1

    554b8534caba1aa54eadf9673978625cddfb050a

    SHA256

    3890f1db1233f3b0032c90f66f819390c2b7ef6848580dfda42966c3ff206bd7

    SHA512

    cd6e0069717ad51773fa45d852ab9e22873d050af38892012285aaa07fd3fd6628a11aa9b705d050a5112ee1824d37c95537b1ecb0d062ad4baebed2c4fbdbc0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c8a0218cc110844a88a6468327dad1f9

    SHA1

    ad8ea2686f65558fdce39677903fb84dbc8483b7

    SHA256

    2950ec55beb93a2e3d31affb8673e540d0ba66419206b8ecb0db8f63e858b335

    SHA512

    9c895c438b58edbf26b17cd548287340e0af0f57749cad4ba109c7d08bcb34a2913fc5b7cf1da9400d7e64e3837a59ac90ab2a7a6c1c02d63563190289d54941

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d8032fe6916456c52d6332a64c15d548

    SHA1

    cde3ad6da4c33a04610d4037e6b28f93935b39f9

    SHA256

    fa39e63c88d31f6f5e19b30f78ec864d1908da6de8ba3cf7a22c2ed2ac16a144

    SHA512

    bdbfa3969c5a940b49779f7cebc48dc4fa64f6b2b45a581c8e6f68e8a431bc06daae18a23146ce25d6d32db0c4ccda1bde2024fa23389aac2a804d7b1e25c2e0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    211c24c05d9bb396cd6f3962f831a94c

    SHA1

    d3017295f9708851d5d7671756e0062b4898a25d

    SHA256

    f2b63cd18e8d3b3584ead890f0dd2a893b40f5b6b82690438dda39883359819f

    SHA512

    017c6121bc358b2fb396640a825df809b31bb3ee7515b087f114fe03dc7400555ba95dab46d9c07eff5fb9600fc9f3c393d3423ed1d7ad1c6ff8e80dd6afe572

  • C:\Users\Admin\AppData\Local\Temp\Cab5B1D.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar5C48.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\Tar5CDB.tmp

    Filesize

    173KB

    MD5

    17c962b8a6b9741b63f93e6eb463091f

    SHA1

    033a34066b61821fe68dc4327dbed6595ca1c838

    SHA256

    58bc72cff239b584091bc626b8a4d7c3a9e5870b0d57a9fbce6582e8ea75e6f8

    SHA512

    25fb66e0c73251deea785b26def1043a3c53f6a2cf7cdfc3d1ddacce35735e926db737a9c1a3ad930a4ef3a1b3aa2c2c59af523e82296347d5fef8e83372392b

  • memory/2200-290-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2200-128-0x0000000000400000-0x0000000001A40000-memory.dmp

    Filesize

    22.2MB

  • memory/2200-0-0x0000000000400000-0x0000000001A40000-memory.dmp

    Filesize

    22.2MB

  • memory/2200-5-0x0000000006120000-0x0000000006121000-memory.dmp

    Filesize

    4KB

  • memory/2200-4-0x0000000000400000-0x0000000001A40000-memory.dmp

    Filesize

    22.2MB

  • memory/2200-1-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2200-903-0x0000000000400000-0x0000000001A40000-memory.dmp

    Filesize

    22.2MB