Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/04/2024, 18:18

General

  • Target

    0694e9d5f302540acda956ba60861153f0c617feffcf556fb874a531d947ff29.exe

  • Size

    103KB

  • MD5

    5d2d36e7d41e9969aa5164d77a06818d

  • SHA1

    f0b1dcba48d2b02641b65a28213fe8908cf9f590

  • SHA256

    0694e9d5f302540acda956ba60861153f0c617feffcf556fb874a531d947ff29

  • SHA512

    aa4327aad1bd66b0c5eb2224fd86dbcb3baad6dcd23c9d8e5cec0376c2f8a760f261fdd862f901985510dea5790c7173f189e432a0a45703dc890f521849b42d

  • SSDEEP

    3072:sm+fXDeHEPTi6HiGLraYV6Z+RwPONXoRjDhIcp0fDlaGGx+cL26nASvVSTvE:sHvOQHXraYoZ+RwPONXoRjDhIcp0fDl4

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0694e9d5f302540acda956ba60861153f0c617feffcf556fb874a531d947ff29.exe
    "C:\Users\Admin\AppData\Local\Temp\0694e9d5f302540acda956ba60861153f0c617feffcf556fb874a531d947ff29.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Users\Admin\AppData\Roaming\Microsoft\winlogdate.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\winlogdate.exe
      2⤵
      • Executes dropped EXE
      PID:2800
    • C:\Windows\SysWOW64\regedit.exe
      regedit /s C:\Users\Admin\AppData\Local\Temp\kb71271.log
      2⤵
      • Adds Run key to start application
      • Runs regedit.exe
      PID:2968
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\kb71271.log

    Filesize

    155B

    MD5

    7a7e633bc48b5bfbca53c568eaa28fe6

    SHA1

    32956698ceca3a79f21be91d655a6265dbd325b2

    SHA256

    7707e565fa020d2b20ff2a9650ff9a5f2d64323474dc4e4253dc4b53c4ecabfc

    SHA512

    3592b4ff34b7d85ddb225d2f0573208e12b3b62a76f3dffe7a36790c26a586544ab52973cb9c0eb587f27352d7e88f0a475d29426f977e53d71628bbd84e6f39

  • C:\Users\Admin\AppData\Local\Temp\~tasyd3.xls

    Filesize

    42KB

    MD5

    3e6e32ff547a361fea67cb9198016a34

    SHA1

    3617400d2f3cbfed0ab1427c50bd7b58e52e43fa

    SHA256

    970eebd3a719020c9fc2f58b58d1c7104498a76e71885ec39b41323b520494e4

    SHA512

    f3cf6b2b2f95d5fca07179e07e0163c2447ac297c1efc88d374d50d99595fcb9c536a32ba8d4c38953d66b7e8425b8883da89fd001324a385a8772ad8343f73b

  • \Users\Admin\AppData\Roaming\Microsoft\winlogdate.exe

    Filesize

    41KB

    MD5

    ba4f88fe44d02a299dbeab18c37f74f3

    SHA1

    f77d5dfccc1796b6f93156dea470c3bf20dba6c8

    SHA256

    8a12e9117f023c7207272ff291ee1a686b636890cd616b92cff990c369d993f6

    SHA512

    badfaaa1a89a8184d7715fbde0a578876863ec517e27096c6621b11dcfdf7585e9039ab33b019fa01dcbed3194a990aecc3fe1c5a3646c54dee9208377c87504

  • memory/2416-36-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2416-37-0x0000000072BAD000-0x0000000072BB8000-memory.dmp

    Filesize

    44KB

  • memory/2416-39-0x0000000072BAD000-0x0000000072BB8000-memory.dmp

    Filesize

    44KB

  • memory/2416-40-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2416-41-0x0000000072BAD000-0x0000000072BB8000-memory.dmp

    Filesize

    44KB