Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 21:38

General

  • Target

    61d6d34e6f1c55cadd529769e099f2bd1d11e65862d0d4bafbb5d35c83dfcdef.exe

  • Size

    599KB

  • MD5

    2e066777691d04ed8e50d32f64f53f6d

  • SHA1

    f9bb1f8e0aeeaf2703e11edc732b65f2ac6eb264

  • SHA256

    61d6d34e6f1c55cadd529769e099f2bd1d11e65862d0d4bafbb5d35c83dfcdef

  • SHA512

    e3887e95c6e242a89304d438b285587153efbe7b14772c8d0abd1d59407baa7d52f429e6925d2d522985c41aa5724c1dd5dfef9f6a8930c0f2262bb2fac873de

  • SSDEEP

    12288:VEQoSfqQMxK16d5r8lYEEHh4ljNzsd6qRYh0Q/k8H:VyxdOqHsYIiY9/N

Malware Config

Signatures

  • Detects executables containing possible sandbox analysis VM usernames 18 IoCs
  • UPX dump on OEP (original entry point) 20 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61d6d34e6f1c55cadd529769e099f2bd1d11e65862d0d4bafbb5d35c83dfcdef.exe
    "C:\Users\Admin\AppData\Local\Temp\61d6d34e6f1c55cadd529769e099f2bd1d11e65862d0d4bafbb5d35c83dfcdef.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Users\Admin\AppData\Local\Temp\61d6d34e6f1c55cadd529769e099f2bd1d11e65862d0d4bafbb5d35c83dfcdef.exe
      "C:\Users\Admin\AppData\Local\Temp\61d6d34e6f1c55cadd529769e099f2bd1d11e65862d0d4bafbb5d35c83dfcdef.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Users\Admin\AppData\Local\Temp\61d6d34e6f1c55cadd529769e099f2bd1d11e65862d0d4bafbb5d35c83dfcdef.exe
        "C:\Users\Admin\AppData\Local\Temp\61d6d34e6f1c55cadd529769e099f2bd1d11e65862d0d4bafbb5d35c83dfcdef.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Windows Sidebar\Shared Gadgets\tyrkish beastiality beast several models .rar.exe

    Filesize

    1.4MB

    MD5

    a0f15397fb2cddd2800dbc2542095e79

    SHA1

    05c2569d9d3f7fa161fae33fa6012c27fcce15b3

    SHA256

    d00fb269d85dfaa6a59cac95724aaaf0d252c23cde8e4d7e3212cbc6588af81e

    SHA512

    6c5e6408f16bd086c82adae92691a6880ce9b55c25144f834de983fa65706b7541966c220931bf2db47b1b9dff15bf396896a662b4b24d471cc40d7c291d929b

  • C:\debug.txt

    Filesize

    183B

    MD5

    789a9f5b497da0e4057d68c8acda8b22

    SHA1

    f2c2544f9a95c65363776362eb111cc9e91be2d1

    SHA256

    e4e71a7a1c0e3113d2078ad8c9309e4882c690032ae0927e87b4d4e862043929

    SHA512

    109e178daa79f34a1199c27588998010c1d0c5b9dd6d9eed4562218a8b3b182301d04fb9f913e67c5f2cf2e8c5187277d2ee9f637840429232d4c40b659dcdd7

  • memory/584-91-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2756-110-0x0000000004AA0000-0x0000000004ABE000-memory.dmp

    Filesize

    120KB

  • memory/2756-67-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2756-90-0x0000000004AA0000-0x0000000004ABE000-memory.dmp

    Filesize

    120KB

  • memory/2756-104-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-111-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-125-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-106-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-108-0x0000000001E80000-0x0000000001E9E000-memory.dmp

    Filesize

    120KB

  • memory/2948-66-0x0000000001E80000-0x0000000001E9E000-memory.dmp

    Filesize

    120KB

  • memory/2948-0-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-114-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-117-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-122-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-95-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-128-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-131-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-134-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-137-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-140-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-143-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2948-146-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB