Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    104s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2024, 01:59

General

  • Target

    sample1.exe.zip

  • Size

    4KB

  • MD5

    c0a40a748b7548aeb7767b8cf5440552

  • SHA1

    d8a24cfc3098669c8674bd726ef460ee6e6b424e

  • SHA256

    2901d8bac40ef63da38ad056646520a95dcb2727c31d8023cea43deb8148b3c6

  • SHA512

    804ded0989f98eb30692fbf94926eb83e221511732a3132f7edce53eab5407564693f2be41c2afdb8a7fda92fb0930451fa124de23e7c4cfff86218df2cfca24

  • SSDEEP

    96:wJPRYsB1makw3NZgva52BpON5uJ1Qn+21mk+eW6p72lnD/oWM8nlx5:2PSspb9Zgjk01Qn+qW6UlD/7Molx5

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\sample1.exe.zip
    1⤵
      PID:2120
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:2980
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe"
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2468
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:524
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1488
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-406356229-2805545415-1236085040-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-406356229-2805545415-1236085040-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:2388
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 520
          2⤵
          • Modifies data under HKEY_USERS
          PID:2464
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:2448
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        1⤵
          PID:2192

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

          Filesize

          1024KB

          MD5

          c5d0435dfb9c35483566b872670e5889

          SHA1

          6a953801732060a197e949031be3e670ba141a32

          SHA256

          8ae38ecb80d0bb15f325b95e09be64235f7bed0e7e4d00293c7eda2c0a9390e6

          SHA512

          0d40517720271c799a790debbde357e65cf29266c220d212fc688ad043461a93cd0674bac48dfead99c211a60af6bcfcfa8d59679652c87ef380163138e72785

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          0800b966e13d9e69d4db3261e6e36c4a

          SHA1

          a38d5580af937cb8d7abed683e85085c4efb16b3

          SHA256

          55639777eca0075318ae397d1edf63933794db8110574221fd7a56182153309d

          SHA512

          d378ba8a45045e28d023172cf6ee67b740db0596132de82c3ddf1006718f0cbe89f9989d234965a519a3285506aeb7bcf5782730a079cbc34eb2f46e1878ce73

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          7e12e5baaf31263864680e1ca40d5391

          SHA1

          af3910ff55bd74bab7bedd06e6e3d13ad09fb924

          SHA256

          2b76cdb7095d0e4e6131ddd54f84cee546b7068d918b51f7b6a79fe693585a1e

          SHA512

          e7fbe07d4045c1da248d8cac06a6355f1c59d8542b1325283e0ef64fddb68f6f1022e9e5f85dfb70f2b838f1ac6c1e193fc21bd2e27e1b778739138638b5767a

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          1c02d47b0389fd9903415ab5dc257ca0

          SHA1

          a99c3f67f81d63cfdeb346a91537c90fbad2b888

          SHA256

          7c58a1a84b7ba332621fcc28f41e72c642e75982908fc609001c2ec42e52dd1b

          SHA512

          c46669e7194ba49ab92ba5c84b8a02ba48fcadbf482c02a156b10f6c13ef4a0348615956addc612c72fceb498c9f50d3a89036bd03d64a8697b3c72a955e8445

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          d13aa9a9c19fdf09c23aa7028ef200bd

          SHA1

          7e769a1bf5132ed357174126cc4bd0f27e866d99

          SHA256

          f8dbd3f84b14937df3019fb60d17b57a4c80f0317992bf6d89ff7e8e61fd71bc

          SHA512

          149ac10e1c485552ca46389aa322a40e6e6c8677d7aa92dcdac1c0db852c67418f8c88cf5b470177073fb3f225316b02683c4797506a417f97d0a4c36d941c55

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          b0e4712906f28fac2fed1bc82bdbba19

          SHA1

          75f283d138e46c8777b32b3e5b2ba2e9bc7fe3a2

          SHA256

          fa7aa30044091e4df48d400aff090d69f40a8514996c0d171c8d84765c37ee57

          SHA512

          a27edbd285f9ce3ba73d83e4555c6d91d19132aaec8c123c197d03f5eaddea8f17774e8e492d9e084531dc5d48d1adca97e0fb153c0e9a7fa22bbc5776974363

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          93f126be2020208e2d063f7f0eb86084

          SHA1

          11a3ebf2f98f68ec36d86dc3136065c3aca61d31

          SHA256

          e8e7f44ec7295f625a4e83e20093031dbf35e9a3b854641434c9d48282b48f4f

          SHA512

          8a105b53e492ec3b12b1b19dbee3cd438d211c49f5dc3e2988005b611ced539a39b76e55ed396a026d6f9d12a2ef264f669a28c618b821c1018f9e5e98234981

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          a69ab3460636346f0f37db38d7aaaa68

          SHA1

          6f00b385a45c586b0f9d9ca7ada98adbd5d9f161

          SHA256

          f795fbd8093ed70042e0632ee3576e26ec6a0f48fbf55762851b61541305e175

          SHA512

          70f2f2f0354e6faf3378d5604466e0537d38777312a687d143f6b1dbbecd266ee8931395c7a2d8a0baa305c46f92d684fb6fa63455a899da1f702f845c9def16

        • C:\Users\Admin\AppData\Local\Temp\CabC390.tmp

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\TarC4CF.tmp

          Filesize

          177KB

          MD5

          435a9ac180383f9fa094131b173a2f7b

          SHA1

          76944ea657a9db94f9a4bef38f88c46ed4166983

          SHA256

          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

          SHA512

          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

        • C:\Users\Admin\AppData\Local\Temp\~DFF6087EB38FAA8927.TMP

          Filesize

          16KB

          MD5

          b22a16ee9eae844ea625ce6551033fc2

          SHA1

          70f15ad27b5a6775d6bd54255f0841ec7b2a5235

          SHA256

          728bf10d8815cd41536810a11a33188104e420df7db5ce023d892226312c567a

          SHA512

          223cf893a4281ffdc883423a3d2deee15bc446ec91421be170ca1b45b32e9749ee7cfadffa44c5a4126ac6a47650734f875b5df0b6547388c5de64020fd7a4d3

        • memory/1488-503-0x00000000017F0000-0x0000000001800000-memory.dmp

          Filesize

          64KB

        • memory/1488-487-0x00000000016F0000-0x0000000001700000-memory.dmp

          Filesize

          64KB

        • memory/1488-526-0x0000000002B30000-0x0000000002B38000-memory.dmp

          Filesize

          32KB

        • memory/1488-532-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

          Filesize

          4KB

        • memory/1488-538-0x0000000002B30000-0x0000000002B38000-memory.dmp

          Filesize

          32KB

        • memory/1488-540-0x0000000001060000-0x0000000001061000-memory.dmp

          Filesize

          4KB

        • memory/1488-549-0x0000000002B90000-0x0000000002B98000-memory.dmp

          Filesize

          32KB

        • memory/1488-555-0x0000000003300000-0x0000000003308000-memory.dmp

          Filesize

          32KB

        • memory/1488-559-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

          Filesize

          4KB

        • memory/2464-561-0x000007FEF26D0000-0x000007FEF2813000-memory.dmp

          Filesize

          1.3MB

        • memory/2464-562-0x000007FEA6E40000-0x000007FEA6E4A000-memory.dmp

          Filesize

          40KB