Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 22:57

General

  • Target

    52fywg.exe

  • Size

    1.0MB

  • MD5

    805dc8ea0c4c626109037b4c6b3f73d2

  • SHA1

    cc4224ed24bc309413f6f4f85dd3ba1cde65c701

  • SHA256

    8748e9a133c0aabc61b04bfe735f1f276157874874a8c08400d8ef21144170cb

  • SHA512

    23a9e2698bd168ce59a2226885b4c6173ff1415a5a843c4d560753a03b51778ad100f7f6765f429048eb6c47ebd4e7ce19097cbc16bb886d6a2b00930e8bd92f

  • SSDEEP

    24576:B8xnT9uMDSdHH2tF7VYPhbQMkDlyGh1l46:B8xxubAWPhbKyGh1l7

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 32 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\52fywg.exe
    "C:\Users\Admin\AppData\Local\Temp\52fywg.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Users\Admin\Documents\ec.sys
      C:\Users\Admin\Documents\/ec.sys
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2456
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\k211.bat" "
        3⤵
          PID:672

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\11.ca

      Filesize

      70B

      MD5

      f7e97e452ebf2e5d1858752e5e51156a

      SHA1

      ae908c2a8c2e670a425a7aad807f5e40d8f42335

      SHA256

      94d55dff4eb41cfd8b5ca832b6ecb3f9c6bcf7d96cb84ae24a6496d015511b59

      SHA512

      3515fc78e868d7a05db3a9f77c2459d9b573d25a9d718335b820becbc296232123f60acb17b5ddc560b259b88caa4eed05e0f77ad4719f07647b7d28df9f7af1

    • C:\Users\Admin\AppData\Local\Temp\k211.bat

      Filesize

      2KB

      MD5

      06af7c4c305e8e390a482e04b5f23a12

      SHA1

      ee0f2820b9c5da1c243315aec03f1aabe54af2e8

      SHA256

      97093292b0ea16c6f109e1d2a4c83bd0436da2ea19b8f0fa7dc35e78bfb851c4

      SHA512

      c71e72924e567c3a7ee5eb3691091b545b55b9e453446ac841a65f93d02c85145d147d856dd7846e3f2843032876730c39e81dc75fdd115f9d581b8fe445135d

    • \Users\Admin\Documents\ec.sys

      Filesize

      42KB

      MD5

      9522a5bbb8a9c5a7033edd962942f0a5

      SHA1

      89dc94c849c33d754a85ceae5d3a6ef45d56d315

      SHA256

      f5c9f0063aea62311673c338a8da321a724dcf8f70b33af34d39b07d29ddd5f6

      SHA512

      6bbcff34c4a7fa3ca0cff2df08ed8667514a42d2d0f2d2ab020f2412918d742c93fd84e75fda2ae96e9b4ac97a5204daed0d87693c76d1588498833e9a3c5e56

    • memory/2456-62-0x0000000000400000-0x000000000041A000-memory.dmp

      Filesize

      104KB

    • memory/2828-50-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-33-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-14-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-20-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-24-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-28-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-31-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-35-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-40-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-42-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-46-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-48-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-2-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-44-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-38-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-12-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-26-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-22-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-18-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-16-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-10-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-7-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-8-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-5-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-61-0x0000000003210000-0x000000000322A000-memory.dmp

      Filesize

      104KB

    • memory/2828-63-0x0000000003210000-0x000000000322A000-memory.dmp

      Filesize

      104KB

    • memory/2828-54-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-6-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-4-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-97-0x0000000010000000-0x000000001003D000-memory.dmp

      Filesize

      244KB

    • memory/2828-98-0x0000000003210000-0x000000000322A000-memory.dmp

      Filesize

      104KB