Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 23:47

General

  • Target

    bf46c0f10ddd3a16518cdd366c48830b.exe

  • Size

    344KB

  • MD5

    bf46c0f10ddd3a16518cdd366c48830b

  • SHA1

    1e5a63266a0fcfdcad8517e439f109977fbba0bc

  • SHA256

    30d17c665801b2bc713301552d45bad970be0e0ca90f09769a6ad385128ff12d

  • SHA512

    f35487040480142cbdb6be99b099471655d5f629c908607aaa988aecb99803b4a4119f5c4ab1c9754379cd372e355a91e202022590e9b677ceec3b9f7341e6a7

  • SSDEEP

    6144:9Hxi2fmOCRXHK4Ms/sjZfHyVZbGMGRC6xs/uZJkBYkRdTZCYGkoS:bJskj5SVoLRCBuEWkRdTEYGkoS

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 8 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf46c0f10ddd3a16518cdd366c48830b.exe
    "C:\Users\Admin\AppData\Local\Temp\bf46c0f10ddd3a16518cdd366c48830b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\GWsBQ.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "mrecss" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\\small.exe" /f
        3⤵
        • Adds Run key to start application
        PID:2572
    • C:\Users\Admin\AppData\Roaming\%NON%\small.exe
      "C:\Users\Admin\AppData\Roaming\%NON%\small.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Users\Admin\AppData\Roaming\%NON%\small.exe
        False
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2644
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2428
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:2624
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\%NON%\small.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\%NON%\small.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2816
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\%NON%\small.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\%NON%\small.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:1256
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3048
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:2448
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SmallerDARK.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SmallerDARK.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SmallerDARK.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SmallerDARK.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • Modifies registry key
            PID:2668
      • C:\Users\Admin\AppData\Roaming\%NON%\small.exe
        False
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GWsBQ.bat

    Filesize

    137B

    MD5

    b60a6d7bd543c2827d9ed1979606fcd6

    SHA1

    de48b503245a05dff5f67e3035e2f512dea8aaf1

    SHA256

    82ab509a50b5e03deee267ec940ea65c3588d54baf2986d08a90cd1a5f98dd71

    SHA512

    c8d654632362862f1a8484c4e7fbc779c73f2f9cd554ee890326865c81eea89142df743a573c00ed08e8a37190871d1c1f33d31e8721f10a036246e2e0113cd0

  • C:\Users\Admin\AppData\Roaming\%NON%\small.exe

    Filesize

    344KB

    MD5

    bf46c0f10ddd3a16518cdd366c48830b

    SHA1

    1e5a63266a0fcfdcad8517e439f109977fbba0bc

    SHA256

    30d17c665801b2bc713301552d45bad970be0e0ca90f09769a6ad385128ff12d

    SHA512

    f35487040480142cbdb6be99b099471655d5f629c908607aaa988aecb99803b4a4119f5c4ab1c9754379cd372e355a91e202022590e9b677ceec3b9f7341e6a7

  • memory/2420-67-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2420-55-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2420-58-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2420-50-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2460-36-0x0000000000400000-0x0000000000777000-memory.dmp

    Filesize

    3.5MB

  • memory/2460-37-0x0000000003A00000-0x0000000003D77000-memory.dmp

    Filesize

    3.5MB

  • memory/2460-39-0x0000000003A00000-0x0000000003D77000-memory.dmp

    Filesize

    3.5MB

  • memory/2460-0-0x0000000000400000-0x0000000000777000-memory.dmp

    Filesize

    3.5MB

  • memory/2460-35-0x0000000003A00000-0x0000000003D77000-memory.dmp

    Filesize

    3.5MB

  • memory/2644-79-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2644-88-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2644-93-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2644-51-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2644-49-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2644-44-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2644-66-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2644-90-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2644-68-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2644-69-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2644-74-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2644-76-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2736-61-0x0000000000400000-0x0000000000777000-memory.dmp

    Filesize

    3.5MB

  • memory/2736-40-0x0000000000400000-0x0000000000777000-memory.dmp

    Filesize

    3.5MB

  • memory/2736-45-0x0000000002B60000-0x0000000002ED7000-memory.dmp

    Filesize

    3.5MB

  • memory/2736-52-0x0000000002B60000-0x0000000002ED7000-memory.dmp

    Filesize

    3.5MB