Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    124s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/03/2024, 05:41

General

  • Target

    2024-03-09_56ae159db30d3c9e1e05fa5c890df4a3_mafia_stonedrill.exe

  • Size

    387KB

  • MD5

    56ae159db30d3c9e1e05fa5c890df4a3

  • SHA1

    582c101e2c2eadcbdc49172d13adbca707aa02c4

  • SHA256

    7a87adb381b7e312636e71d63c412c807536e6bc12309101f139d83e9934c389

  • SHA512

    5cef420aab2bdc9e9d612d92b964bd9273449c18521952cc9f5c2f0c80b547adff4b791bf6f09459b685e71181dc5e88cbb598ad13e119ce85f3df654eda4620

  • SSDEEP

    12288:BqYXje0DF9k64/QSywqP0T8oIN1AHDFhY25fC2WF9sY204P:BqYDF9k64/Q9j28okAHDHY25fC2WF9sp

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-09_56ae159db30d3c9e1e05fa5c890df4a3_mafia_stonedrill.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-09_56ae159db30d3c9e1e05fa5c890df4a3_mafia_stonedrill.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v RESTART_STICKY_NOTESS /f /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\StikyNote.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2008
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v RESTART_STICKY_NOTESS /f /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\StikyNote.exe"
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:3068
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\2024-03-09_56ae159db30d3c9e1e05fa5c890df4a3_mafia_stonedrill.exe" "C:\Users\Admin\AppData\Local\Temp\StikyNote.exe"
      2⤵
        PID:3000
      • C:\Users\Admin\AppData\Local\Temp\StikyNote.exe
        "C:\Users\Admin\AppData\Local\Temp\StikyNote.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2644
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2132

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      6892bd4d2e80d39ac8ab07d8da62169f

      SHA1

      7f0435fba0b94626f9f57e5f1806b9158753442d

      SHA256

      acaf0e8f57f4706269d8765b846be07641cb84678f186f5c15f97e5ff3c4dc79

      SHA512

      117fe160b8c7990b2ad804e940de15c877350fa3ea01e8fdf51178edd0d1ca646f7de9b2ed2c9680b1f1c5477504be8541d2772f5b9e17da1655cc977f45dab5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      c003d5749a0d4b24d3c6ceee57e9568e

      SHA1

      33449c287b810084635c7b14120548bcc7fa4c15

      SHA256

      adaf56c0bcbd6aded77a78b6d7411fff67f1c1442d19b0e4729aa4645fee0aa0

      SHA512

      fae3ae71cacf4bdc4bfec53e0a34da16ef91f3999abb3ad34eefd9e90e0f7221d2d122b5db6291883ce65a5e14e18348e3b395ed9bd9cea9f6d870bb4fa74376

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      602349ac88f0f02c17cbc2043b51a5b3

      SHA1

      164295cb3031807ac01bde52506fb88ffc599b87

      SHA256

      485c7cab472a4a42ec83123d0d03c324d51ca0015c90a61998265fbef67cbe3d

      SHA512

      e0331e39e59ae4f5f9ca5aecec557ef140e010285ef33a19e0e445e052c7dcf220e04e56d62906525f8da4aabb190eea7e29dd32558d1644fce03e41558311e8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d010d1f37dc93514fb45b9073c09912c

      SHA1

      6a7d3dbd7145d1e1caac0b4cb83c251ec09f216f

      SHA256

      f84c087e86dbc3aacb2e24bdec0dae5f2b3ce338bd586fa8da68cc8ecde8e8b7

      SHA512

      e62e5f8aced47af3c5ca635b0be1f9e6d42e417c76967cc72ccd2c35bc73a98b93fdebe5f26c69b18358ee3579f10fb28915be7d1b6114b911d63800ca17f7cb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      4fba726e71321428a477c2217cc390ee

      SHA1

      f5998a2789060af8c35b5fe401679aadcd2d1c29

      SHA256

      e9288e6f8b373d80a45386f557be1b50088e8a511c7bf40eb26321551c92ab78

      SHA512

      9da1bba1d03832f6b48ace37b25137f9d04e65da187e312946447296694d422cb607aea7b8dd51384b9066b78625cb7b641c9ba7bed0fa09ac6221e2662d6b05

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      364736f300ef593b03dd0247065fce02

      SHA1

      90ff883da6eb2a76cf2b460b4b1863a05b7e3dfc

      SHA256

      ced29714d72b1443dc7f8700aeb855e30f7635116bdb242da37bc84cfa8727cc

      SHA512

      00ab6c3a63544254c9b6b12e088b210917d83ca1f0613bd1ca6b740ccb686356e258d68dbfc01d9332aded0fbb1e4bc45f314b63f24904c41b21128edaad447f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      a47c6cc6812db229595a440739835a11

      SHA1

      bea6ce7176caeb22c565dca998483305652b0c21

      SHA256

      75d264b99711ae9ef823b7e361384d6a056ae59859d728f3a3055afb5457d31f

      SHA512

      9d6252542ed0a729925c02a9942960a84a35e8ecead9519ffea95931cc59c2f6d3605c61af41a1a0c6c8ae2e694bd8d24856f1c0126230bd8b350c64e014233b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      55ea89b824e4a40cad27bb66408b43bd

      SHA1

      afe9eca4bf0a607d15e12a2e2e57f284c93862e7

      SHA256

      9b96cc0f0328ec9cf36aa093d2041453acb979515ac3a5db0529e37a29fa6e68

      SHA512

      a681160f32a791e3549d2e1371b1e1bade0a7b2a9a2018d781153cd74668b0166c139bf590b4cb4c8b157cc8dbd43af1c7d822b23e02bf4ba53d17215318a39f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ecd33cdaf4d674543d4a6144c4439cfe

      SHA1

      03029b99a0caf871785043cebdb36ed5013322f0

      SHA256

      e72825f42964bd60b6ba2fd40a9a72f6d5514a71de58ae8f43f3d8b0ba3f6df8

      SHA512

      5d239a811f5767cb7563c5e831074665bd9e336e997973d6acf4d4fdbfbbf3ecb10988b283339f5a35aa3892ce06b550c480566e633565589098a6e614135bcb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      32b529b098196f74ae9463e134718ab3

      SHA1

      6a37c5fea3623e47ede9e174164c69a7bca31b32

      SHA256

      adb5d771744179a86a87568e08b3bd82e58c8d25e6ac066997ac1e3c8ad0cd7a

      SHA512

      43f64a50e35bb84cb65496795a1a104fb5962f055ce6634dcb7ebc03e15aed43550f04b8b2694dbb87e450a75e34002cca4753e6ab9d1676245d57e2c56e2278

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ba74406b30bcc9e946ebb36e730c83ee

      SHA1

      f4c367c5f4ca98b7dafdf943d0fbb28a6ac4786b

      SHA256

      e6c681d1532ae720b28f6cfa4480818eed941a2759923b9f7438d0ab0b25283b

      SHA512

      53cd45dadad12b65670db697c42d3e36b02b80b63434748b3f843dcd7469411449542c3417a6ad52131626ad54492985681b12eac1b211785c0640825df845b5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f76656e68fc52d94053d04e57a74cd43

      SHA1

      6df1a8f52684da2bc9a82f1e5f4530db81163ee0

      SHA256

      29af4a325ca284a3090d81f5eee36dd56e3bbd65f66724f5e807b3a12f0308ae

      SHA512

      084b44b4d5a39b910878397842d8a24592610f6a8cfda85b68eb36ab162348fd849c4883804cf5574267eb766fc53510158710121c43333ca0f2cdc25ea2a35d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      fc420f76dd756c36297d08df2db4e3f1

      SHA1

      02e3a8b29550ea316ca4196504a694edbeeae923

      SHA256

      67a11b71672762a18eeff950acae9083931d596ff9b00b4a8fbb516ec40198a7

      SHA512

      7ed58b79f028cf05a33fd77a3c5a6394cad003a23c70195434e5f14417c8d22d36708883cbc4e0ee5124454dc4797678e736fe6cefa9d36e3ab9e276a16c908b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      9b8b7b4919e50e6d742a0233bec06e5e

      SHA1

      48872525fc1ae6278bba152e87bb4fc100fe4d36

      SHA256

      c407943f9ad7a1579e44550d1c025de2ffd5964c32996a1f81ac42b2464a7806

      SHA512

      3bf0f58cd0231e1d592bd249b8bef2404081cd0d352f39d001e2e0859c7ab2748b57ca96b67bfba259c78e2acbf5cc28411595233fdd438edac4e0bc096cd626

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      42966ea9f93efe0c37c3e961779ca6cb

      SHA1

      236d83cc08bcbfa56d32580135f442727e1e3a3f

      SHA256

      f53de96c3a9096e9e981399ce98391fae9267f983101e60febca7fcb79383c7e

      SHA512

      052d4816a838d0544c80ec439051a397ddf38866c130ff5deeeda1bf228284c3d15d195c7a23164f8197ae612e63c53188c91b2d8bde3c1b5308d4d369bc0c7f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      8dc3826aa1f62d2aee6702a4d244c558

      SHA1

      84aad1cea75106e1586ee3d9322e6b7d3a5da649

      SHA256

      1674058d5b9d855e5a1b705bd8694d9732170f5eda178cd7e4b0e246c68b2635

      SHA512

      2acde19ca71837d2607c51aba9915bab89f8ecb6065e611df031eddbb6738d4704af533d5c6982887facda8a6a9ebac387081f446338916c87a112ac887a81ee

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      599ed86c7c8c1e1be21676421d28650b

      SHA1

      792d7ec11bb39001965952d11efd9a5c4eb88606

      SHA256

      17967543af25502ce028d6dd0f2df9cb24cc48ad24581129edf3b39a086ac934

      SHA512

      7b117de4e19b299a89299d3527ba8edc0a4cda06cbfe5a4f6229a30c3ba1d4eb49856dddb39fa4bd7002613e1417780907185a3202721411965530db295b380a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      86520c633750c8b8650729f8ef6f88a1

      SHA1

      774dfd2138380c0d0ca46b435d97fb8ff87d25ea

      SHA256

      9320bd1de55d19d1d740013d92e2e6b93241b2f12db3b51badcff345be675640

      SHA512

      d866b9b30b8c0582382f3fb348815272b641a2fadb67a4016b78352e793b96be9ac7f00254e9c919bf3a8c2b1176f681b0b220a07e7b8514792f20f6d1d28b1d

    • C:\Users\Admin\AppData\Local\Temp\CabAA74.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\StikyNote.exe

      Filesize

      387KB

      MD5

      56ae159db30d3c9e1e05fa5c890df4a3

      SHA1

      582c101e2c2eadcbdc49172d13adbca707aa02c4

      SHA256

      7a87adb381b7e312636e71d63c412c807536e6bc12309101f139d83e9934c389

      SHA512

      5cef420aab2bdc9e9d612d92b964bd9273449c18521952cc9f5c2f0c80b547adff4b791bf6f09459b685e71181dc5e88cbb598ad13e119ce85f3df654eda4620

    • C:\Users\Admin\AppData\Local\Temp\TarABB4.tmp

      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    • C:\Users\Admin\AppData\Local\Temp\setup.tmp

      Filesize

      47B

      MD5

      72a392628d7f368bb9bc9689a694f55a

      SHA1

      feacee9c66028a333446f2c968bcb3d567a4033d

      SHA256

      afa60141aee93d7e3f3d8d296e36de9956f588a6cad99f8e79ce36ab88e828dd

      SHA512

      76f40be7d3e0de960c7bc199fd094c64588841e5b6a1b99bd7fd2e3b53f9e381ded992ee6d67848dd4fda755416792ff6e29bf0acf1a348796dcf7e9bf96229e

    • memory/2336-3-0x0000000000090000-0x0000000000093000-memory.dmp

      Filesize

      12KB

    • memory/2336-1-0x0000000000090000-0x0000000000093000-memory.dmp

      Filesize

      12KB

    • memory/2336-6-0x0000000000090000-0x0000000000093000-memory.dmp

      Filesize

      12KB

    • memory/2616-17-0x0000000077190000-0x00000000772A0000-memory.dmp

      Filesize

      1.1MB

    • memory/2644-16-0x0000000000400000-0x0000000000469000-memory.dmp

      Filesize

      420KB