Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

bf1b72b046...55.exe

windows7-x64

7

bf1b72b046...55.exe

windows10-2004-x64

10

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Bundfradra...es.ps1

windows7-x64

1

Bundfradra...es.ps1

windows10-2004-x64

1

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 16:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bf1b72b0469fe09e9e544ec62774f07d6c568aadb8aecbdbefe8b35d8e586c55.exe

  • Size

    652KB

  • MD5

    4f9d76ea7b2a35dd03a4c2f398c07329

  • SHA1

    223a687ff0525c2bb51c0b5c9c285efd3c700fc1

  • SHA256

    bf1b72b0469fe09e9e544ec62774f07d6c568aadb8aecbdbefe8b35d8e586c55

  • SHA512

    ee227a209e5167b015056ae640753d076a3ccf741d7d94588339af7c6611fd33243a33ee5e5d46b88f384fc4d2237f784efff718a8c59f55cadcb8bc4b2d9752

  • SSDEEP

    12288:13K4CdvtoL5XHL6f+MIo3SSkKMaZNsf6TcBHRNsZe7+843+Kr:13/evW9Xm+N4/4YcBR6Zeq84V

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf1b72b0469fe09e9e544ec62774f07d6c568aadb8aecbdbefe8b35d8e586c55.exe
    "C:\Users\Admin\AppData\Local\Temp\bf1b72b0469fe09e9e544ec62774f07d6c568aadb8aecbdbefe8b35d8e586c55.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden $derremc = Get-Content 'C:\Users\Admin\AppData\Local\Hydrolysate\Hjmose\opsprtterknive\Bundfradrag\Halvtredsindstyvendedels\Afproeve204\Slagterbnkes.Mel' ; powershell.exe "$derremc"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nst24E0.tmp\nsExec.dll
    Filesize

    7KB

    MD5

    675c4948e1efc929edcabfe67148eddd

    SHA1

    f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

    SHA256

    1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

    SHA512

    61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

    Download Submit

  • memory/3020-14-0x0000000073EA0000-0x000000007444B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3020-15-0x0000000073EA0000-0x000000007444B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3020-16-0x0000000002700000-0x0000000002740000-memory.dmp

    Filesize

    256KB

    Download

  • memory/3020-17-0x0000000002700000-0x0000000002740000-memory.dmp

    Filesize

    256KB

    Download

  • memory/3020-18-0x0000000002700000-0x0000000002740000-memory.dmp

    Filesize

    256KB

    Download

  • memory/3020-19-0x0000000073EA0000-0x000000007444B000-memory.dmp

    Filesize

    5.7MB

    Download