Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18/04/2024, 21:37

General

  • Target

    kav21.3.10.391en_26074.exe

  • Size

    2.6MB

  • MD5

    d0e47e632ba9144605d7bec32e126737

  • SHA1

    9c02c04bed4cc77baab6ad8f22a9e780fedb61e3

  • SHA256

    915ceba5edafdf1ffc45792ede4269ada50809960c2d0e74fe554010f25b9afc

  • SHA512

    62b87616b11ec3299288f6015ad693e869f3dc795dfce7e3186d31e7e24e4490537ef68d739ed6aec1cd306c33057eff8827e8f1022503d0be3b42544b8e04a0

  • SSDEEP

    49152:847Nlau3ZiJvDrOV9Gcwb/alTe/iXMNLdcE/EBSDre/2jX8oL:8eNlau3UJOV9GvZbRDe/2zl

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe
    "C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe"
    1⤵
    • Loads dropped DLL
    • Checks for any installed AV software in registry
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Checks for VirtualBox DLLs, possible anti-VM trick
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2091.0\au_setup_EBE73292-FDCB-11EE-A6D5-5A791E92BC44\startup.exe
      "C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2091.0\au_setup_EBE73292-FDCB-11EE-A6D5-5A791E92BC44\startup.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe" /-self_remove -l=en -xpos=346 -ypos=71 -prevsetupver=21.3.10.391.0.21.0
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1292
    • C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe
      "C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\09237EBEBCDFEE116A5DA597E129CB44;2236"
      2⤵
        PID:2596

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2091.0\au_setup_EBE73292-FDCB-11EE-A6D5-5A791E92BC44\dynamic.ini

      Filesize

      98B

      MD5

      8052359711301152986c22daf2d05d47

      SHA1

      7a969cc68fbb85c687a9d3ace86c182bf0b8d05b

      SHA256

      509f94751eda031fff8c5b8f91e615b1ce3b156f3844adb89862d84287099566

      SHA512

      aff238980c0158e5163bee86feb7c0ff8bc511f6515aa5df9bde0281e33cd5ff7edd3559ab1eb93ab16c28d8021b6c9618d16f5f058285557555e418ec47b585

    • C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2091.0\au_setup_EBE73292-FDCB-11EE-A6D5-5A791E92BC44\startup.exe

      Filesize

      2.6MB

      MD5

      52c9f5d97af0e8d7345f51091dc905e6

      SHA1

      ebbf72c39d30654130c9bcde627abb33a22210ac

      SHA256

      1c44c2e745d5b0b9c16e26b04f062401426218fac5797c789ca9c02576e30617

      SHA512

      3a74a5fda0cf1758311f62c55d90474be91c057974bfd18637fd79754a0fe6551ceac80270845ff7377c41dc32cdf5ba37c7184c65ff6322101326359f6d8267

    • C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2091.0\au_setup_EBE73292-FDCB-11EE-A6D5-5A791E92BC44\static.ini

      Filesize

      5KB

      MD5

      11069b61a2b705e749d8f48d291d7a3e

      SHA1

      f1c0d52e26d8d653471643487c561fe3811c6145

      SHA256

      14f8f4f4f67cfa6c322c4e46c245294b2e3632b1209bc6588e755cc7b7d2a825

      SHA512

      5feec50c42cb7046206f54f53b25e3df422bb4fc61a965c6fdb7605f25fcb10bd67deece0e1b14ffee0f6d11dea2638715c9654f2ceab0b5f85d4f8f12c4643b

    • C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2091.0\kdscrl.rdb.z

      Filesize

      4KB

      MD5

      bdea6885cfeffb2de552578f50925fd6

      SHA1

      c0ccb051167947ea03fac4182f3a9b96dc6f29cd

      SHA256

      f9f10d25becf3013ea958d1a4c87c7e819c2f083eaf2e0e28c80af5c71c37beb

      SHA512

      4e1084132d938b38dfe4f99fad69675efb7d9998242bd1093315db93e2822225b8d71e5b5e5278c4c70d290a98af6014b430dc356ea84cba265b0e60651cdab1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

      Filesize

      471B

      MD5

      b922e9fdf6b5c52c23408584f77e1d74

      SHA1

      fb5384f9b9dee982b7a073adfb342f877c054a32

      SHA256

      1849402b6d507e23c861adfd6096e01205d76520a7af99792b02e619de140f24

      SHA512

      cbca0a8059a4af94ae56b541e3429af86298ffa9e4f3a790ca474a48946fa28a70001b7e945e114cd7087e5bf2c81a6923d931024807fbd6d1a769372248c314

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      65d7dc01714db22611ae1e9ba6f17053

      SHA1

      b9597d4b0e3b398693d0ebd92ada4fb1041ca9e7

      SHA256

      72b63e333a7d19216fbb60206dabd5aa197514b1eb40cc3d92064a22c9b89e8f

      SHA512

      eba5d39fb116276d6ad9d8f6048c01b4bd27cb5c3203b4d5d03835daec711995c31e53fc1e7d2d2868e8a730d769e17971967d31038c393b2248001c1a69a097

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

      Filesize

      400B

      MD5

      36a5ae12ac0bdbeb2d79bd924fec4bbc

      SHA1

      4b543ae4edb4fa6553fb15d6f38fec97bd97350e

      SHA256

      3e67e3d7deae0cec868de821eb7735f52442ea0b985be539495b3b4ce9bd7b4e

      SHA512

      c717509e84c1245186e16d7df12a87b5447c932e8abcccb7b25a16feeadce2b7a596169ed2a50f5bdecf046cd4ae5ae7570b3d96dfecf42585d6c995a9f4e413

    • C:\Users\Admin\AppData\Local\Temp\CabCE49.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\CabD9FA.tmp

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Local\Temp\EBE73291-FDCB-11EE-A6D5-5A791E92BC44\check_new_version.html

      Filesize

      1KB

      MD5

      b79ab8145423e4714f4d3623a7913eef

      SHA1

      0f17053bd76724cb244866c537de47ea6124331a

      SHA256

      59a439debcea1f039382e258a337031f9878450afbce19a2a52a37783009fafe

      SHA512

      239663617d89722d8c4187804901436c456444b92655ade83c1fbf04231467693869efdc689123724dcc58d63665efb5dbb2a835fe49144facbea361c8ae9151

    • C:\Users\Admin\AppData\Local\Temp\EBE73291-FDCB-11EE-A6D5-5A791E92BC44\kis-loading.gif

      Filesize

      10KB

      MD5

      69d4b9b309bfa6a87f7620647bafd2d0

      SHA1

      c9f6bb4d6494bbd7a47d52874da43501afb97c6d

      SHA256

      f056164cf99799234c90e2318e90ab5d83d0fd855118224286ff0680ee455734

      SHA512

      2aa95fa187d24b4310af4e72a49c8fe665b84aa15ed33ca5b78a88da861554948d5fdb2f0b59ba8560b8c9dc1d4ff8cf5b37bdc1cbdb4fdf7a6e6fbe7e4f4b1a

    • C:\Users\Admin\AppData\Local\Temp\EBE73291-FDCB-11EE-A6D5-5A791E92BC44\kis-logo.png

      Filesize

      4KB

      MD5

      18f81892daa926fec1d30324b4cd9367

      SHA1

      0f0753271f09aecd6731c9dd998d15df5f967b7e

      SHA256

      681a96b96b5e0425fc74be929d29164528bf0bc0a84ac97952c011e407e23d9b

      SHA512

      5e07a3f44f6135291909680abb62e21d0c6bca899905aafa66cc3b436e77430a3ea96a95b54f2705e1f9dd49b60a855d986c4d76ea65dc9a9a5edf3d2748550d

    • C:\Users\Admin\AppData\Local\Temp\F21F1DD1-FDCB-11EE-A6D5-5A791E92BC44\jquery-1.12.4.min.js

      Filesize

      94KB

      MD5

      618538b4ab9639d444e962729a927f15

      SHA1

      dacc1f76630a9708add066819b1aabf8dce01056

      SHA256

      27d92130c0321dad5a03760fd5ac98a3d04ed4c94d88418fe6d50da1f7fc5cbe

      SHA512

      bcb6754ea246939a19a917cc0b810e1753c1b0f1a8b1b7e652128ef15dee4fc79111e4d88fe12f9188449a307e82240d0261af402d783428edfe5785c860372d

    • C:\Users\Admin\AppData\Local\Temp\F21F1DD1-FDCB-11EE-A6D5-5A791E92BC44\jquery.custom_select.min.js

      Filesize

      5KB

      MD5

      d2c620c462b75696eea1fb22fb23602a

      SHA1

      900f78eb8e1103be1535af5e76d1bed686cdcce3

      SHA256

      dd678d32073078552e0e2c35eed78f16cc8d6e8662d4734518561a1b183f775c

      SHA512

      40e1180b63b328c22cfacc40529cbda2409a54fbbbd5813fcc5f8dcdf95ad7fcd74ea96382e3a2d0bcfed9e68c208f7733b7c630edee7e2013c9a5459091c02c

    • C:\Users\Admin\AppData\Local\Temp\F21F1DD1-FDCB-11EE-A6D5-5A791E92BC44\kis-print.css

      Filesize

      306B

      MD5

      1304724dd5001b2600fc5bd80c098f1e

      SHA1

      87ec458c25a35e3a45c2a6ede9ec16ec4d4c7093

      SHA256

      2481b34b48fd96b194405da621e8e5f19142dcb55744f9c9a93591705cb697fd

      SHA512

      4371fbd6ba7e84ae827ec73bec4c903275e4373c16063b6fe63ca157a4db346df5617a9db5c9e1fdcb661f220f6dcbc1f7e4003805dba9fa7a279fc882aebeeb

    • C:\Users\Admin\AppData\Local\Temp\F21F1DD1-FDCB-11EE-A6D5-5A791E92BC44\kis-script-lte-ie8.js

      Filesize

      1KB

      MD5

      5134186180074c51639d7a514919ed23

      SHA1

      23bddb16b3b6c3a687dfcfed5c1a6c23c0ed1f0a

      SHA256

      33e84b33ff911257e3a6a303c08a2cc178827dadb7dfd7c951e096866e02ad5e

      SHA512

      8ad216cee9192533801b0f10f3bc149506f75dfd2cd554e801e1732b474629435ada4549473176b5440c57c112986dd198dcf508fb0e55ed3a050a75b0fa3d82

    • C:\Users\Admin\AppData\Local\Temp\F21F1DD1-FDCB-11EE-A6D5-5A791E92BC44\kis-script.js

      Filesize

      306B

      MD5

      026425ccbf4417eefa444285707132ef

      SHA1

      a953b9f6781d4b6daa2eedc0c45d358f2a472370

      SHA256

      97e5f342227ea23c27c1b660f111847fcdd9d7b23c1d248c733a36f983fd7f04

      SHA512

      a266e2f9f10620347f0d05d081362086e81c67fb7c5f4a74c26cca54686f6afb2f2933b1f7afb6d9c96382ff4e4e3cf2f0f38cdd162175cdefccb5909b1aa6c3

    • C:\Users\Admin\AppData\Local\Temp\F21F1DD1-FDCB-11EE-A6D5-5A791E92BC44\kis-style.css

      Filesize

      29KB

      MD5

      2b4bd0afd0e9dd5c90fb8c3bb4a5d619

      SHA1

      a4a1a61d43e8f897d36fef9e1927848de2d312cc

      SHA256

      f9963b403e053f6bfa7c87cad3c10dd55cf1f94fefe00c6380921440e28b48d2

      SHA512

      c0b284552502304f05dd10606e01b0d35210a27f982bba8a605f2939a2ac43890636175431eab99edc45cfc2825fe1b1cffabd8067d9eaa7ad59af466a052974

    • C:\Users\Admin\AppData\Local\Temp\F21F1DD1-FDCB-11EE-A6D5-5A791E92BC44\welcome_page_kavkis.html

      Filesize

      2KB

      MD5

      725363d5b886e02f1c5476f79590b577

      SHA1

      be2e4e60b62c8705443972015a86a23c7ec4bd50

      SHA256

      29f0688682087bc5262f8abb97d0804a1fc8a7ff16685c24b6197e61cc1a6401

      SHA512

      eeabe64d4828c5633fb687c72d75b3524f62b9a4a912b3fb36d280e0c32e7d79fe12f92e8bb962ccbe10a1770016ac108d853b5046089316d25d7e2d6bf39413

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\61RPN2ER.txt

      Filesize

      104B

      MD5

      1708e3ef892548bf3c29a8d5231a3a91

      SHA1

      ae7dd19c14d7ab85b7c771d2508873bca7d2e2cf

      SHA256

      1c8fde3b205e9042dfa7a1ce710323ce8cb916fb896896a76df458886e3d72da

      SHA512

      15cf16a367a01a3a9bbe3f06c58ff1cf79734c3afbdd811fe876349532a3dc6b311687523ea5cddde0145b6d49961a39c112aaa4f9cbfb4f08e8c5600350b7b0

    • \Users\Admin\AppData\Local\Temp\09237EBEBCDFEE116A5DA597E129CB44\setup.dll

      Filesize

      5.1MB

      MD5

      7c0418acfb24086ede591a7e1d3df7ac

      SHA1

      9bee27188d04bf44fa2e95a8fcb575497396f2b0

      SHA256

      d7b6905661d364be51bdb7e8e2ef9832ed0c33f056c4f40368f9ae6c1b4e608a

      SHA512

      e2c45aad07d5db230c9758fde258ab5589160d81a8723a5d246fe3287fca1a192b162c33f35144a44d16dd655e4a86694acd55c9279a15b795777ede2b14f71c

    • \Users\Admin\AppData\Local\Temp\0DD1F12FBCDFEE116A5DA597E129CB44\setup.dll

      Filesize

      5.1MB

      MD5

      47bba658d9b8c74a8c94d7024ba608b6

      SHA1

      902be0a993f37db76eb5ad237aae5568c20bad95

      SHA256

      3279d6e132eb640cef3d74c5edf851a93e9553d7c889a6e665360058405af5f5

      SHA512

      8a8635083db6cc825cac63ca834cc1b1ec5412746db293f1bf44af5731265044c45108a54adf428e83111237c1f3e60f7dd048ec7066b655780145c80569a1e0

    • memory/1292-87-0x0000000077270000-0x0000000077280000-memory.dmp

      Filesize

      64KB

    • memory/1292-85-0x0000000077270000-0x0000000077280000-memory.dmp

      Filesize

      64KB

    • memory/1292-86-0x0000000077270000-0x0000000077280000-memory.dmp

      Filesize

      64KB

    • memory/2236-0-0x0000000077280000-0x0000000077290000-memory.dmp

      Filesize

      64KB

    • memory/2236-1-0x0000000077280000-0x0000000077290000-memory.dmp

      Filesize

      64KB

    • memory/2236-2-0x0000000077280000-0x0000000077290000-memory.dmp

      Filesize

      64KB

    • memory/2596-255-0x0000000077250000-0x0000000077260000-memory.dmp

      Filesize

      64KB

    • memory/2596-256-0x0000000077250000-0x0000000077260000-memory.dmp

      Filesize

      64KB

    • memory/2596-257-0x0000000077250000-0x0000000077260000-memory.dmp

      Filesize

      64KB