Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

1193403a19...be.exe

windows7-x64

8

1193403a19...be.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/04/2024, 18:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1193403a19781c8f1da8d08a19083336f6ac3bee263d0119436a9d3dc86845be.exe

  • Size

    230KB

  • MD5

    b75651939e852ce3e2c8466f3c02aefa

  • SHA1

    5c077c2b724b36555b738f015377463caa72225b

  • SHA256

    1193403a19781c8f1da8d08a19083336f6ac3bee263d0119436a9d3dc86845be

  • SHA512

    0fd11b02fdcaa6c5a535757676b3d1675d2f110bf0525b394279b3bb69d8f5cb3948ca93ad31fca75e43501b305096d415cf6633f16b6394421fe0f44946768b

  • SSDEEP

    3072:sr+Fu2II+HiXMcI/AKJj/+rzTPe9oPxM5DNmHWVcqelSxbfS6954bpqyZALx0XN+:/MHD3/AKsP2f5hBkpq0rpS

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 60 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1193403a19781c8f1da8d08a19083336f6ac3bee263d0119436a9d3dc86845be.exe
    "C:\Users\Admin\AppData\Local\Temp\1193403a19781c8f1da8d08a19083336f6ac3bee263d0119436a9d3dc86845be.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Windows\AE 0124 BE.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2292
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops autorun.inf file
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2624
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1660
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    PID:2456
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2132
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003A0" "00000000000005A0"
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    923af0e1128bc53be07c278a2ee9d36a

    SHA1

    a657905981decdf5a9d9b57bc89be98f9259f530

    SHA256

    f28ec4a0b63847db376c8b32c40ac6204fc8ca3b4c971913a2a5ef8cf3859fa0

    SHA512

    4a1f0f3466711478d8d487e2085bbed24e8f16c4e12fa73341c02e76e0cc165fc9b3fe793d62eadba4062d050f4fbce81755d8a4585e54f06f5796f59ce2a811

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab5763.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Windows\AE 0124 BE.msi
    Filesize

    230KB

    MD5

    80d6e84f1670c18ecbe7b1c4d14035c0

    SHA1

    a1966fb520e12ec6697c2a902bde48415ec1fc91

    SHA256

    d3c2829b303b5783a84632e43c7d63c0ab8316d4d7779678f4ffcdc6bed9ed02

    SHA512

    2421c48b3841eb8b5258b99b87412ca11d6bff6618c6aa178e0038f9026c32c2912ad14b00a407fa8b2bf766953fce73fe6a53a18c89e607db1425f98866bdaa

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    21B

    MD5

    9cceaa243c5d161e1ce41c7dad1903dd

    SHA1

    e3da72675df53fffa781d4377d1d62116eafb35b

    SHA256

    814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

    SHA512

    af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

    Download Submit

  • \Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    130KB

    MD5

    3c9b1eaec6c0553ec55cc981859ad52d

    SHA1

    dc1b89778d23517677327fc7265419f507ce5f60

    SHA256

    bb42a5c15238d5b38ec51c0d7069d35a62e84c058c0c3d995a934e8dfba3a728

    SHA512

    8caccc427dda37b1b40e32eea0523d67dc7391bd6ca1d3c570fed86d50a5b3e80b48395d022407049c23e82e3f9a41d3323fbab94ac7520887d6f82df358caa5

    Download Submit

  • memory/2056-12-0x0000000003C30000-0x00000000046EA000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/2476-55-0x0000000003550000-0x000000000400A000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/2520-56-0x00000000033A0000-0x0000000003E5A000-memory.dmp

    Filesize

    10.7MB

    Download

  • memory/2520-182-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2520-382-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download