Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    210s
  • max time network
    243s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/04/2024, 00:02

General

  • Target

    a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe

  • Size

    37KB

  • MD5

    38f80bc71d69f2afd987673fc8d044bd

  • SHA1

    b36d1172ef54128edcf5ec580fa0107077037730

  • SHA256

    a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74

  • SHA512

    e1fa6dd0dc39b8eb83109baf71fb5fe999f30458972ed5b82337f6d0d5f00b29413c307bb7b03463f0d21d2ee3d6e288427ce9a10554f1deec1ab2d74c81dcbf

  • SSDEEP

    768:LZ+Zxe90i19C92eocaWTmNtY6coZOuLPfBXMqR:LaiZ19C92eocaWTKtNJZOuTfBXMqR

Malware Config

Signatures

  • Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1248
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1320
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1380
          • C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe
            "C:\Users\Admin\AppData\Local\Temp\a5df302b5048eef64d951d9f68a96578bd079ef251f6a27ee278c99a6eca8b74.exe"
            2⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2472
            • C:\Users\Admin\AppData\Local\Temp\lcm.exe
              "C:\Users\Admin\AppData\Local\Temp\lcm.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1056
              • C:\Users\Admin\AppData\Local\Temp\lsias.exe
                "C:\Users\Admin\AppData\Local\Temp\lsias.exe"
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of UnmapMainImage
                • Suspicious use of WriteProcessMemory
                PID:2528
                • C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe
                  "C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe"
                  5⤵
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of UnmapMainImage
                  • Suspicious use of WriteProcessMemory
                  PID:1072
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe -set TESTSIGNING ON
                    6⤵
                    • Modifies boot configuration data using bcdedit
                    PID:3056
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe -set TESTSIGNING ON
                    6⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2112
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe -set TESTSIGNING ON
                    6⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2140
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe -set TESTSIGNING ON
                    6⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1964
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe -set TESTSIGNING ON
                    6⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1040
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe -set TESTSIGNING ON
                    6⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1936
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe -set TESTSIGNING ON
                    6⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1508
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe -set TESTSIGNING ON
                    6⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1612
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe -set TESTSIGNING ON
                    6⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1844
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit.exe -set TESTSIGNING ON
                    6⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1152
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\WQADD6F.bat"
                  5⤵
                    PID:2960
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 116
                      6⤵
                      • Program crash
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2456
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:1416
            • C:\Windows\system32\conhost.exe
              \??\C:\Windows\system32\conhost.exe "844197778-5421874441554756392107014615618454053763437781111536675309-344092748"
              1⤵
                PID:2496

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\Measom\xiafet.exe

                Filesize

                593KB

                MD5

                bea750cba9f5641ddb32ae44022a156c

                SHA1

                89f94f035cf11ab407bb3852c1b2d5a08de97554

                SHA256

                08552f6f3fd2bc67826e7b702a7d02e6e0fbef8fd474f1e436034e8f70aa2a1c

                SHA512

                588230efb8f0fff018595d957e118db8310a3a1ff4dc365723063c62e33fb197c40cb15f2e22aa5bd9004ec7aa1ae06ce1bbd26ef702a22859608c8b0394c37e

              • \Users\Admin\AppData\Local\Temp\lcm.exe

                Filesize

                37KB

                MD5

                7dbba94859c6d13b02aa6010301d942e

                SHA1

                95719bc59b38ea41e2944899de0171a7a064c52e

                SHA256

                8a4c97df18716d25c508608a6baaf8e940dded4f68cb4924943bc94375f4e327

                SHA512

                08151b054efb79826d470abc44f65923e1b42a93490f9428f5f767439d5fe0dca604a4786524a511ca8ea89c8a8286847cc77eed579a345c8e29accab7758a12

              • \Users\Admin\AppData\Local\Temp\lsias.exe

                Filesize

                593KB

                MD5

                b765fa6dafe847a21badd35b2db70ce0

                SHA1

                8de082342547052dbe43bf9d9df0ec5fc4586eb9

                SHA256

                b943dea63930db983b6d4524dbecf76bc94ece24bc68ee69a658c3e05164ffb9

                SHA512

                4ccdc9bad6e957f5df3f7ccb3cd11085b44fa234334dacbf042ec942ed67b244178681426f85d38d7ca4c5583d5b546a5c43ba6d6c098d5f63522ed06c99c674

              • memory/1056-11-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

              • memory/1072-42-0x00000000002A0000-0x00000000002A6000-memory.dmp

                Filesize

                24KB

              • memory/1072-33-0x0000000000400000-0x0000000000499000-memory.dmp

                Filesize

                612KB

              • memory/1072-40-0x0000000000400000-0x0000000000499000-memory.dmp

                Filesize

                612KB

              • memory/1072-93-0x0000000000400000-0x000000000046D000-memory.dmp

                Filesize

                436KB

              • memory/1072-91-0x0000000000400000-0x000000000046D000-memory.dmp

                Filesize

                436KB

              • memory/1072-87-0x00000000002A0000-0x00000000002A6000-memory.dmp

                Filesize

                24KB

              • memory/1248-48-0x0000000001EB0000-0x0000000001F1D000-memory.dmp

                Filesize

                436KB

              • memory/1248-43-0x0000000001EB0000-0x0000000001F1D000-memory.dmp

                Filesize

                436KB

              • memory/1248-44-0x0000000001EB0000-0x0000000001F1D000-memory.dmp

                Filesize

                436KB

              • memory/1248-46-0x0000000001EB0000-0x0000000001F1D000-memory.dmp

                Filesize

                436KB

              • memory/1248-50-0x0000000001EB0000-0x0000000001F1D000-memory.dmp

                Filesize

                436KB

              • memory/1320-53-0x0000000001C50000-0x0000000001CBD000-memory.dmp

                Filesize

                436KB

              • memory/1320-54-0x0000000001C50000-0x0000000001CBD000-memory.dmp

                Filesize

                436KB

              • memory/1320-55-0x0000000001C50000-0x0000000001CBD000-memory.dmp

                Filesize

                436KB

              • memory/1320-56-0x0000000001C50000-0x0000000001CBD000-memory.dmp

                Filesize

                436KB

              • memory/1380-61-0x00000000026E0000-0x000000000274D000-memory.dmp

                Filesize

                436KB

              • memory/1380-59-0x00000000026E0000-0x000000000274D000-memory.dmp

                Filesize

                436KB

              • memory/1380-58-0x00000000026E0000-0x000000000274D000-memory.dmp

                Filesize

                436KB

              • memory/1380-60-0x00000000026E0000-0x000000000274D000-memory.dmp

                Filesize

                436KB

              • memory/1416-66-0x0000000002460000-0x00000000024CD000-memory.dmp

                Filesize

                436KB

              • memory/1416-64-0x0000000002460000-0x00000000024CD000-memory.dmp

                Filesize

                436KB

              • memory/1416-68-0x0000000002460000-0x00000000024CD000-memory.dmp

                Filesize

                436KB

              • memory/1416-70-0x0000000002460000-0x00000000024CD000-memory.dmp

                Filesize

                436KB

              • memory/2456-134-0x0000000000300000-0x0000000000301000-memory.dmp

                Filesize

                4KB

              • memory/2456-131-0x0000000077700000-0x0000000077701000-memory.dmp

                Filesize

                4KB

              • memory/2456-130-0x0000000000350000-0x00000000003BD000-memory.dmp

                Filesize

                436KB

              • memory/2472-0-0x0000000000400000-0x0000000000407000-memory.dmp

                Filesize

                28KB

              • memory/2528-81-0x000000006FFF0000-0x0000000070000000-memory.dmp

                Filesize

                64KB

              • memory/2528-84-0x000000006FFF0000-0x0000000070000000-memory.dmp

                Filesize

                64KB

              • memory/2528-76-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

                Filesize

                436KB

              • memory/2528-77-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

                Filesize

                436KB

              • memory/2528-78-0x000000006FFF0000-0x0000000070000000-memory.dmp

                Filesize

                64KB

              • memory/2528-80-0x000000006FFF0000-0x0000000070000000-memory.dmp

                Filesize

                64KB

              • memory/2528-79-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

                Filesize

                436KB

              • memory/2528-26-0x0000000000400000-0x000000000046D000-memory.dmp

                Filesize

                436KB

              • memory/2528-82-0x000000006FFF0000-0x0000000070000000-memory.dmp

                Filesize

                64KB

              • memory/2528-83-0x000000006FFF0000-0x0000000070000000-memory.dmp

                Filesize

                64KB

              • memory/2528-85-0x0000000077700000-0x0000000077701000-memory.dmp

                Filesize

                4KB

              • memory/2528-74-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

                Filesize

                436KB

              • memory/2528-86-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

                Filesize

                436KB

              • memory/2528-20-0x0000000000310000-0x0000000000311000-memory.dmp

                Filesize

                4KB

              • memory/2528-88-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

                Filesize

                436KB

              • memory/2528-19-0x0000000000400000-0x0000000000499000-memory.dmp

                Filesize

                612KB

              • memory/2528-75-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

                Filesize

                436KB

              • memory/2528-21-0x0000000000400000-0x000000000046D000-memory.dmp

                Filesize

                436KB

              • memory/2528-109-0x0000000000400000-0x000000000046D000-memory.dmp

                Filesize

                436KB

              • memory/2528-73-0x0000000001DC0000-0x0000000001E2D000-memory.dmp

                Filesize

                436KB

              • memory/2528-39-0x0000000000400000-0x0000000000499000-memory.dmp

                Filesize

                612KB

              • memory/2960-99-0x0000000000240000-0x00000000002AD000-memory.dmp

                Filesize

                436KB