Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

e0b45febef...27.exe

windows7-x64

9

e0b45febef...27.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    119s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/03/2024, 03:53 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e0b45febefed60610310f7f72ab71827.exe

  • Size

    512KB

  • MD5

    e0b45febefed60610310f7f72ab71827

  • SHA1

    16f08ce86234178a7611d90356e921a0abba1ef2

  • SHA256

    13d504f539cccb868b6d61e1f74b7a2c7eb32f092f330404ec45ed8d03ee841b

  • SHA512

    18d1e0ba3fd560570aeacec5b7013011b8c0a9c06add04577f2b7e2c96e10a69876b7c3602b94515d688968e8acd72e5b63d623e3e662281a9e5573066564cf2

  • SSDEEP

    12288:0+h9St2Ma70zIIc91Dwws4zruXic2O/3E4Y:0+h9OY70z+warul3E4Y

Score
9/10
evasion

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0b45febefed60610310f7f72ab71827.exe
    "C:\Users\Admin\AppData\Local\Temp\e0b45febefed60610310f7f72ab71827.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Loads dropped DLL
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Users\Admin\AppData\Local\Temp\n3016\s3016.exe
      "C:\Users\Admin\AppData\Local\Temp\n3016\s3016.exe" f376d8ee11074cc159096b94ZjNSqAIRgbLADUlQGPMFbwFnDf/13etBYs2vyZUZ/jLroKv0u+YWj1t2FHZoulLRpii404j543/SA9XK7fYTBwbl7M1Rv8wg1DKCFb+RqJoUArqCNKJIkwdH8I0GWz5xkumgH1+8xE1LbrmBHkxxNEXe /v "C:\Users\Admin\AppData\Local\Temp\e0b45febefed60610310f7f72ab71827.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2392

Network

  • flag-us
    DNS
    ocsp.thawte.com
    s3016.exe
    Remote address:
    8.8.8.8:53
    Request
    ocsp.thawte.com
    IN A
    Response
    ocsp.thawte.com
    IN CNAME
    mpki-ocsp.digicert.com
    mpki-ocsp.digicert.com
    IN CNAME
    fp3011.wpc.2be4.phicdn.net
    fp3011.wpc.2be4.phicdn.net
    IN CNAME
    fp3011.wpc.phicdn.net
    fp3011.wpc.phicdn.net
    IN A
    152.199.19.74
  • flag-us
    GET
    http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
    s3016.exe
    Remote address:
    152.199.19.74:80
    Request
    GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.thawte.com
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Age: 4598
    Cache-Control: public, max-age=300
    Content-Type: application/ocsp-response
    Date: Wed, 27 Mar 2024 03:54:21 GMT
    Last-Modified: Wed, 27 Mar 2024 02:37:43 GMT
    Server: ECAcc (lhc/789F)
    X-Cache: HIT
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    X-XSS-Protection: 1; mode=block
    Content-Length: 5
  • flag-us
    GET
    http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
    s3016.exe
    Remote address:
    152.199.19.74:80
    Request
    GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.thawte.com
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Age: 4598
    Cache-Control: public, max-age=300
    Content-Type: application/ocsp-response
    Date: Wed, 27 Mar 2024 03:54:21 GMT
    Last-Modified: Wed, 27 Mar 2024 02:37:43 GMT
    Server: ECAcc (lhc/789F)
    X-Cache: HIT
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    X-XSS-Protection: 1; mode=block
    Content-Length: 5
  • flag-us
    DNS
    crl.thawte.com
    s3016.exe
    Remote address:
    8.8.8.8:53
    Request
    crl.thawte.com
    IN A
    Response
    crl.thawte.com
    IN CNAME
    crl-symcprod.digicert.com
    crl-symcprod.digicert.com
    IN CNAME
    crl.edge.digicert.com
    crl.edge.digicert.com
    IN CNAME
    fp2e7a.wpc.2be4.phicdn.net
    fp2e7a.wpc.2be4.phicdn.net
    IN CNAME
    fp2e7a.wpc.phicdn.net
    fp2e7a.wpc.phicdn.net
    IN A
    192.229.221.95
  • flag-se
    GET
    http://crl.thawte.com/ThawtePCA.crl
    s3016.exe
    Remote address:
    192.229.221.95:80
    Request
    GET /ThawtePCA.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: crl.thawte.com
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Age: 6050
    Cache-Control: public, max-age=3600
    Content-Type: application/pkix-crl
    Date: Wed, 27 Mar 2024 03:54:21 GMT
    Last-Modified: Wed, 27 Mar 2024 02:13:31 GMT
    Server: ECAcc (lhd/35A2)
    X-Cache: HIT
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    X-XSS-Protection: 1; mode=block
    Content-Length: 604
  • flag-us
    DNS
    th.symcd.com
    s3016.exe
    Remote address:
    8.8.8.8:53
    Request
    th.symcd.com
    IN A
    Response
    th.symcd.com
    IN CNAME
    mpki-ocsp.digicert.com
    mpki-ocsp.digicert.com
    IN CNAME
    fp3011.wpc.2be4.phicdn.net
    fp3011.wpc.2be4.phicdn.net
    IN CNAME
    fp3011.wpc.phicdn.net
    fp3011.wpc.phicdn.net
    IN A
    152.199.19.74
  • flag-us
    GET
    http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEH1FCfATdbNJ8t5mvxWkjNc%3D
    s3016.exe
    Remote address:
    152.199.19.74:80
    Request
    GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEH1FCfATdbNJ8t5mvxWkjNc%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: th.symcd.com
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Age: 1
    Cache-Control: public, max-age=86400
    Content-Type: application/ocsp-response
    Date: Wed, 27 Mar 2024 03:54:21 GMT
    Last-Modified: Wed, 27 Mar 2024 03:54:21 GMT
    Server: ECAcc (lhc/788E)
    X-Cache: HIT
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    X-XSS-Protection: 1; mode=block
    Content-Length: 1441
  • flag-us
    DNS
    d8fb9.northstar.api.socdn.com
    s3016.exe
    Remote address:
    8.8.8.8:53
    Request
    d8fb9.northstar.api.socdn.com
    IN A
    Response
    d8fb9.northstar.api.socdn.com
    IN CNAME
    615321.parkingcrew.net
    615321.parkingcrew.net
    IN A
    76.223.26.96
    615321.parkingcrew.net
    IN A
    13.248.148.254
  • flag-us
    GET
    http://d8fb9.northstar.api.socdn.com/installer/52fe2c91-49dc-40b7-b209-1f140a000013/13279082/config
    s3016.exe
    Remote address:
    76.223.26.96:80
    Request
    GET /installer/52fe2c91-49dc-40b7-b209-1f140a000013/13279082/config HTTP/1.1
    User-Agent: DownloadMR/3.1.37 (MSIE 9.11;Windows NT 6.1.7601 SP1;WOW64;.NET CLR 2.0.50727 SP2; .NET CLR 3.0 SP2; .NET CLR 3.5 SP1; .NET CLR 4; .NET CLR 4.0;DB IE11;m=X9SRE/X9SRE-3F/X9SRi/X9SRi-3F;u=Admin;northstar;ecc5fae7-eb08-7218-c1c2-c58c5648ceff)
    Accept-Language: en-US
    Host: d8fb9.northstar.api.socdn.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Wed, 27 Mar 2024 03:54:25 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Server: nginx
    Vary: Accept-Encoding
    Vary: Accept-Encoding
    X-Redirect: skenzo
    X-Buckets: bucket102
    X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_SEICq4gFevBMBFf3unkRBACOD6kKmg9Y9UcYg5RaudM6pWq3saKfTUUMGMFVfHuRItr/G5XWYMroAbF8n1/3uA==
    X-Template: tpl_CleanPeppermintBlack_twoclick
    X-Language: english
    Accept-CH: viewport-width
    Accept-CH: dpr
    Accept-CH: device-memory
    Accept-CH: rtt
    Accept-CH: downlink
    Accept-CH: ect
    Accept-CH: ua
    Accept-CH: ua-full-version
    Accept-CH: ua-platform
    Accept-CH: ua-platform-version
    Accept-CH: ua-arch
    Accept-CH: ua-model
    Accept-CH: ua-mobile
    Accept-CH-Lifetime: 30
    X-Domain: socdn.com
    X-Subdomain: d8fb9.northstar.api
  • flag-us
    POST
    http://d8fb9.northstar.api.socdn.com/installer/52fe2c91-49dc-40b7-b209-1f140a000013/13279082/event
    s3016.exe
    Remote address:
    76.223.26.96:80
    Request
    POST /installer/52fe2c91-49dc-40b7-b209-1f140a000013/13279082/event HTTP/1.1
    User-Agent: DownloadMR/3.1.37 (MSIE 9.11;Windows NT 6.1.7601 SP1;WOW64;.NET CLR 2.0.50727 SP2; .NET CLR 3.0 SP2; .NET CLR 3.5 SP1; .NET CLR 4; .NET CLR 4.0;DB IE11;m=X9SRE/X9SRE-3F/X9SRi/X9SRi-3F;u=Admin;northstar;ecc5fae7-eb08-7218-c1c2-c58c5648ceff)
    Accept-Language: en-US
    Content-Type: application/x-www-form-urlencoded
    Host: d8fb9.northstar.api.socdn.com
    Content-Length: 4219
    Expect: 100-continue
    Response
    HTTP/1.1 403 Forbidden
    Server: awselb/2.0
    Date: Wed, 27 Mar 2024 03:54:27 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 138
    Connection: keep-alive
  • 152.199.19.74:80
    http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D
    http
    s3016.exe
    783 B
     914 B
     6
    4

    HTTP Request

    GET http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D

    HTTP Response

    200

    HTTP Request

    GET http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D

    HTTP Response

    200
  • 192.229.221.95:80
    http://crl.thawte.com/ThawtePCA.crl
    http
    s3016.exe
    357 B
     1.1kB
     5
    3

    HTTP Request

    GET http://crl.thawte.com/ThawtePCA.crl

    HTTP Response

    200
  • 152.199.19.74:80
    http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEH1FCfATdbNJ8t5mvxWkjNc%3D
    http
    s3016.exe
    462 B
     2.0kB
     5
    4

    HTTP Request

    GET http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEH1FCfATdbNJ8t5mvxWkjNc%3D

    HTTP Response

    200
  • 76.223.26.96:80
    http://d8fb9.northstar.api.socdn.com/installer/52fe2c91-49dc-40b7-b209-1f140a000013/13279082/event
    http
    s3016.exe
    5.8kB
     4.4kB
     15
    14

    HTTP Request

    GET http://d8fb9.northstar.api.socdn.com/installer/52fe2c91-49dc-40b7-b209-1f140a000013/13279082/config

    HTTP Response

    200

    HTTP Request

    POST http://d8fb9.northstar.api.socdn.com/installer/52fe2c91-49dc-40b7-b209-1f140a000013/13279082/event

    HTTP Response

    403
  • 8.8.8.8:53
    ocsp.thawte.com
    dns
    s3016.exe
    61 B
     175 B
     1
    1

    DNS Request

    ocsp.thawte.com

    DNS Response

    152.199.19.74

  • 8.8.8.8:53
    crl.thawte.com
    dns
    s3016.exe
    60 B
     200 B
     1
    1

    DNS Request

    crl.thawte.com

    DNS Response

    192.229.221.95

  • 8.8.8.8:53
    th.symcd.com
    dns
    s3016.exe
    58 B
     172 B
     1
    1

    DNS Request

    th.symcd.com

    DNS Response

    152.199.19.74

  • 8.8.8.8:53
    d8fb9.northstar.api.socdn.com
    dns
    s3016.exe
    75 B
     143 B
     1
    1

    DNS Request

    d8fb9.northstar.api.socdn.com

    DNS Response

    76.223.26.96
    13.248.148.254

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarBC73.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit

  • \Users\Admin\AppData\Local\Temp\n3016\s3016.exe
    Filesize

    230KB

    MD5

    abaf13cb23de482dc944ab5b51ca3aac

    SHA1

    76837356db96dd56b647aba60f1adbbdc7b200fe

    SHA256

    b02fad5ac5234401505e1682c86f526951e8ded726687088c30987321f7c105e

    SHA512

    cc2aac30490511e49e1268f5df9139d176a3b849e663ad3b739e2f1cb50a6e084c465772ded5f694d5ec6f19ac40a57e5e64f7c47515f212476c20cbe9d6bce3

    Download Submit

  • memory/2392-77-0x0000000000A50000-0x0000000000AD0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2392-22-0x000007FEF6220000-0x000007FEF6BBD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2392-76-0x0000000000450000-0x0000000000462000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2392-23-0x0000000000A50000-0x0000000000AD0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2392-78-0x0000000000A50000-0x0000000000AD0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2392-79-0x0000000000A50000-0x0000000000AD0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2392-80-0x0000000000A50000-0x0000000000AD0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2392-81-0x0000000000A50000-0x0000000000AD0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2392-82-0x0000000000A50000-0x0000000000AD0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2392-83-0x000007FEF6220000-0x000007FEF6BBD000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/2392-84-0x0000000000A50000-0x0000000000AD0000-memory.dmp

    Filesize

    512KB

    Download

  • memory/2392-85-0x000007FEF6220000-0x000007FEF6BBD000-memory.dmp

    Filesize

    9.6MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.