Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 17:27

General

  • Target

    0471a72e634f745a52b49caaff6bce17f72ff4ac7a270d41227433b7d5aaca90.exe

  • Size

    511KB

  • MD5

    bb33d405123d7e87bb75db6beeb2675b

  • SHA1

    faca0c666b9b16d2e509c72527af6510e7f2cfb0

  • SHA256

    0471a72e634f745a52b49caaff6bce17f72ff4ac7a270d41227433b7d5aaca90

  • SHA512

    c70a29d63c640a594ca468629ad060b83dc24ce2851574664d8e8d09a26d68684a8f4eadd74e2acc69a149d93749efd419e5185fb6ee088235bcd60c9b25eb5d

  • SSDEEP

    12288:W2KxcTVqIvgTyKq5NcbyrlAG8BwHuR/h4QMl:W2KxcAvbymFeHuh6QMl

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0471a72e634f745a52b49caaff6bce17f72ff4ac7a270d41227433b7d5aaca90.exe
    "C:\Users\Admin\AppData\Local\Temp\0471a72e634f745a52b49caaff6bce17f72ff4ac7a270d41227433b7d5aaca90.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\n8973\s8973.exe
      "C:\Users\Admin\AppData\Local\Temp\n8973\s8973.exe" 16baf303aa7e30f1c4020b54W/JICbsB0g+/KmoFFD0N3nHilP5W5Nf9VSop7pgEU+Yln6wVnrBdq3DcTmhj3toDT0wUNEOasB+nSibZpBhNgVqDqZud6UQIdUi6+1ZdzPxFtPjEEh/jmc3EXAD7w8RYS+G0ewnHLQyrV0hTqPRcD/+u /v "C:\Users\Admin\AppData\Local\Temp\0471a72e634f745a52b49caaff6bce17f72ff4ac7a270d41227433b7d5aaca90.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

  • C:\Users\Admin\AppData\Local\Temp\Tar4DAA.tmp

    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

  • \Users\Admin\AppData\Local\Temp\n8973\s8973.exe

    Filesize

    230KB

    MD5

    abaf13cb23de482dc944ab5b51ca3aac

    SHA1

    76837356db96dd56b647aba60f1adbbdc7b200fe

    SHA256

    b02fad5ac5234401505e1682c86f526951e8ded726687088c30987321f7c105e

    SHA512

    cc2aac30490511e49e1268f5df9139d176a3b849e663ad3b739e2f1cb50a6e084c465772ded5f694d5ec6f19ac40a57e5e64f7c47515f212476c20cbe9d6bce3

  • memory/2136-77-0x0000000000AA0000-0x0000000000B20000-memory.dmp

    Filesize

    512KB

  • memory/2136-80-0x0000000000AA0000-0x0000000000B20000-memory.dmp

    Filesize

    512KB

  • memory/2136-75-0x00000000004C0000-0x00000000004D2000-memory.dmp

    Filesize

    72KB

  • memory/2136-76-0x0000000000AA0000-0x0000000000B20000-memory.dmp

    Filesize

    512KB

  • memory/2136-78-0x0000000000AA0000-0x0000000000B20000-memory.dmp

    Filesize

    512KB

  • memory/2136-22-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2136-79-0x0000000000AA0000-0x0000000000B20000-memory.dmp

    Filesize

    512KB

  • memory/2136-23-0x0000000000AA0000-0x0000000000B20000-memory.dmp

    Filesize

    512KB

  • memory/2136-81-0x0000000000AA0000-0x0000000000B20000-memory.dmp

    Filesize

    512KB

  • memory/2136-82-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2136-83-0x0000000000AA0000-0x0000000000B20000-memory.dmp

    Filesize

    512KB

  • memory/2136-84-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

    Filesize

    9.6MB

  • memory/2136-85-0x0000000000AA0000-0x0000000000B20000-memory.dmp

    Filesize

    512KB

  • memory/2136-86-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

    Filesize

    9.6MB