Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    18/04/2024, 15:36

General

  • Target

    Спецификация контракта Казахстан – Российская Федерация.exe

  • Size

    517KB

  • MD5

    a6b7d5f2bfefda4b0663a7ba6bbc041c

  • SHA1

    c5f5c00c55140cdddd198c32e5639ab41c0166db

  • SHA256

    fc682a6fc3ac615b76230f7d1418e9d1b0f325e8d4a23df978453d07c9ce5f43

  • SHA512

    9df274c79609c787836563ce606b0c5b4aba8a8e00a27ffc6b98cc1a9e66dfb6d4f276f4495194cfe471661ce30138439bb96b46d6f2dedd82e1494078187bd3

  • SSDEEP

    12288:fzA/ggggjiOW6Ype3OIo+X2zvysLOxwph8Ow+:U/ggggji56Ykq+XoysLMo8Ow+

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Спецификация контракта Казахстан – Российская Федерация.exe
    "C:\Users\Admin\AppData\Local\Temp\Спецификация контракта Казахстан – Российская Федерация.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1176
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Deklasstrr=Get-Content 'C:\Users\Admin\AppData\Roaming\skabiose\slgtsarvens\prender\Fellator\Paletter\Lowbyte\Avanceringen157\Rekrt.Bal';$Tapetal=$Deklasstrr.SubString(7309,3);.$Tapetal($Deklasstrr)"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
        3⤵
          PID:2508
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Program Files (x86)\windows mail\wab.exe"
          3⤵
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of WriteProcessMemory
          PID:2568
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Udbytterigst% -windowstyle minimized $Genopbygget=(Get-ItemProperty -Path 'HKCU:\Kapitalvrdien\').Nonoptical;%Udbytterigst% ($Genopbygget)"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1964
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Udbytterigst% -windowstyle minimized $Genopbygget=(Get-ItemProperty -Path 'HKCU:\Kapitalvrdien\').Nonoptical;%Udbytterigst% ($Genopbygget)"
              5⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:1984

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      7832fe1a28d3669ee1428e72ba56c2ea

      SHA1

      173ba6f978c4abf6565b11ce562a2bf16817a2f0

      SHA256

      257e7326dba148110ab034befc1911943c2746268371351db993a65884a98821

      SHA512

      1e919c199906dddbc2854ceb4a5274c869ee2b46420587c9d27b5529c5aff3968faf75d4e1f3197e18267ddc56cbfeb16ead094f09e6146bb0e933b0b8b223b1

    • C:\Users\Admin\AppData\Local\Temp\Cab17A8.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar1935.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • C:\Users\Admin\AppData\Roaming\skabiose\slgtsarvens\prender\Fellator\Paletter\Lowbyte\Avanceringen157\Patentets.Pri204

      Filesize

      333KB

      MD5

      fe3b114b11116efde2078f4754e719a4

      SHA1

      a85b985689fd1866fe055a1b842b76248ad82a2e

      SHA256

      78083b10cd94d81830dbe5e5187c765c82f2d7f1a7c98b0debb87ac6689a8506

      SHA512

      bfcf02b0c4cda208002d9a8d3ebd4525c4fd64ef86d57f8bde16a577778c3d4cbe62a35be18db75b2d353746dc335b5179153bb8c1c817ab5b77f6aa151c5423

    • C:\Users\Admin\AppData\Roaming\skabiose\slgtsarvens\prender\Fellator\Paletter\Lowbyte\Avanceringen157\Rekrt.Bal

      Filesize

      56KB

      MD5

      2354362f1cb0a39baef7da6969832048

      SHA1

      ed2a3597370eea69ea017af285c99d1b60556a0c

      SHA256

      f5129323c012e960d4b1a619a95757cc81675275e4c795883004c54da5ed3bb2

      SHA512

      a09dbc69627bd42180fe9cf8fc7234798e30296de3a2b35a0c071e7507d9a63a5dc3f0873183a8bd93e929e05ea5d647323cf2905f4550cfb8cc5ee07353999a

    • memory/2568-27-0x0000000077800000-0x00000000779A9000-memory.dmp

      Filesize

      1.7MB

    • memory/2568-124-0x0000000002090000-0x0000000007931000-memory.dmp

      Filesize

      88.6MB

    • memory/2568-125-0x00000000779F0000-0x0000000077AC6000-memory.dmp

      Filesize

      856KB

    • memory/2568-29-0x00000000779F0000-0x0000000077AC6000-memory.dmp

      Filesize

      856KB

    • memory/2568-28-0x0000000077A26000-0x0000000077A27000-memory.dmp

      Filesize

      4KB

    • memory/2860-15-0x0000000002330000-0x0000000002370000-memory.dmp

      Filesize

      256KB

    • memory/2860-19-0x00000000740B0000-0x000000007465B000-memory.dmp

      Filesize

      5.7MB

    • memory/2860-22-0x0000000005E10000-0x0000000005F10000-memory.dmp

      Filesize

      1024KB

    • memory/2860-24-0x0000000006340000-0x000000000BBE1000-memory.dmp

      Filesize

      88.6MB

    • memory/2860-25-0x0000000077800000-0x00000000779A9000-memory.dmp

      Filesize

      1.7MB

    • memory/2860-26-0x00000000779F0000-0x0000000077AC6000-memory.dmp

      Filesize

      856KB

    • memory/2860-20-0x00000000740B0000-0x000000007465B000-memory.dmp

      Filesize

      5.7MB

    • memory/2860-21-0x0000000002330000-0x0000000002370000-memory.dmp

      Filesize

      256KB

    • memory/2860-18-0x00000000050F0000-0x00000000050F4000-memory.dmp

      Filesize

      16KB

    • memory/2860-16-0x0000000005E10000-0x0000000005F10000-memory.dmp

      Filesize

      1024KB

    • memory/2860-8-0x00000000740B0000-0x000000007465B000-memory.dmp

      Filesize

      5.7MB

    • memory/2860-12-0x0000000002330000-0x0000000002370000-memory.dmp

      Filesize

      256KB

    • memory/2860-11-0x0000000002330000-0x0000000002370000-memory.dmp

      Filesize

      256KB

    • memory/2860-10-0x0000000002330000-0x0000000002370000-memory.dmp

      Filesize

      256KB

    • memory/2860-9-0x00000000740B0000-0x000000007465B000-memory.dmp

      Filesize

      5.7MB