Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 02:06

General

  • Target

    ae4b291d804328b5fa801c4dcacd7afd29d1c7037e6609a2315ea58ab7bcf7c0.exe

  • Size

    218KB

  • MD5

    b3b557bfd1a5553e6b4fcf82c82314cb

  • SHA1

    1b2fb11b0393c81865de45946c5c2f714199aaf4

  • SHA256

    ae4b291d804328b5fa801c4dcacd7afd29d1c7037e6609a2315ea58ab7bcf7c0

  • SHA512

    a4b402346321456dfe363193b415c7651a18106be0d732712b8fcc58f85c2542ea5d0ace13e6458f6eaf5158fab4257273b2d33d37754f5aecf64b1e0609bb82

  • SSDEEP

    3072:xvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:11SyAJp6rjn1gOObn4b6h9h

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae4b291d804328b5fa801c4dcacd7afd29d1c7037e6609a2315ea58ab7bcf7c0.exe
    "C:\Users\Admin\AppData\Local\Temp\ae4b291d804328b5fa801c4dcacd7afd29d1c7037e6609a2315ea58ab7bcf7c0.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      PID:1456

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e9641998254c1b4d27ca31dea4cb7940

    SHA1

    c8a4bd373f4eb63b148f45f2c364665176d94f16

    SHA256

    8364f51ebe300dde5b697bc52c56970fc01e2531ce8f1730a00e0f1f71a6e33d

    SHA512

    e28ad140442aa986a1085f4679de11cdda35e900066b33ff5c519d54c62890cbc2e37acfc76bc22a158d4dfa26c7ab644352f4a2d563efcf42979525f5435559

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    941565cd3f866a92e061e2c29e164294

    SHA1

    fafcd85d602611195b9344844c3a09f1f00d8506

    SHA256

    1bf8084490a95904291c4ecd420e2794a2bd9fafea4ecebf36654e3b39edba2d

    SHA512

    97b1519cfbfd053e80ba7a93b4edc060d4a83a4fea324ec4803dbb31443a488d27f3b6b7cb440105e53ef771d62d311f2a16fd5c5afdd4285cbcdfc6f2be11a7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    f82373d4ccfab1267f9afdbea0362a07

    SHA1

    193e406bc437c7d058dad360d9c720085670ab38

    SHA256

    805bb4924cdf921e8191bed3cfb2c42c66f7c7c0084cfd2d82d4c6b4e1311181

    SHA512

    9128e96fb94c4548f2b37fdf8819b1cb3489730f83efb0a71d63b0540f66fe0b5f2b5315c1aaa31874760f99af965ded03f2ca20c5751ee27c02dcd170316e08

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\login[1].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Temp\7C1C.tmp

    Filesize

    481B

    MD5

    e5bf8f69d86173ffa964b139947ac444

    SHA1

    de43f4eac112f60020959de549725e1af43eaf3d

    SHA256

    8e947cdad9fc6fc7acffdb188bc3e306fe1e1c00f51015a361286e3d27b4814e

    SHA512

    8f2d4fce7811164be1c56bd367c063845f5d6c76206c2c222a932a123c844a84347ca28841a0c9040c315c66502d10b0c74c060ac3afee82b9ec78b7d74000e6

  • C:\Users\Admin\AppData\Local\Temp\B44D.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\Cab5E58.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\F168.tmp

    Filesize

    457B

    MD5

    531ec87a0b2f9477a52d88b111d0d46a

    SHA1

    50a72e5752075309f91c062e0282a7e7cd1e751e

    SHA256

    4875b451859b1eb8d0d3b040b1bb8d654d212edb6d9c721cf0f4372129579385

    SHA512

    07994963fd76b31ef0ba2c7f418dcb3ee0290f6baca2d8ec63a6e6b861557b13fbc20d2f0a10a66f35c4d72d4d2c1920ac88b96174604f2f8856868912327da1

  • C:\Users\Admin\AppData\Local\Temp\Tar5E6B.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\Tar5F6A.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • \Windows\AppPatch\svchost.exe

    Filesize

    218KB

    MD5

    ec6786be8627080eb69fb5c9652c0afa

    SHA1

    0dcd11db9e3b38d78759ab4652b316a6c30f3f80

    SHA256

    6432d7a4ecb8c95aac95a4b0ff0908098357a74cd8a2ac0d5e5c67bcef581deb

    SHA512

    e9d4644ee841a392be2942db20e6f8c00812abec7337183d4ebf272ccb092fbae2b152932fc43e37da36f576dbccb762fd424d76659fda17e6d587d0a73b0337

  • memory/1456-49-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-84-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-71-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-73-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-83-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-82-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-80-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-79-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-78-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-76-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-75-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-72-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-70-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-68-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-67-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-65-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-64-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-62-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-60-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-58-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-57-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-56-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-54-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-52-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-51-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-23-0x0000000002320000-0x00000000023C8000-memory.dmp

    Filesize

    672KB

  • memory/1456-48-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-46-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-44-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-43-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-42-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-19-0x0000000002320000-0x00000000023C8000-memory.dmp

    Filesize

    672KB

  • memory/1456-41-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-81-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-77-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-40-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-74-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-69-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-66-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-63-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-39-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-61-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-59-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-55-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-53-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-50-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-47-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-45-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-38-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-32-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-34-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-36-0x00000000024D0000-0x0000000002586000-memory.dmp

    Filesize

    728KB

  • memory/1456-26-0x0000000002320000-0x00000000023C8000-memory.dmp

    Filesize

    672KB

  • memory/1456-28-0x0000000002320000-0x00000000023C8000-memory.dmp

    Filesize

    672KB

  • memory/1456-30-0x0000000002320000-0x00000000023C8000-memory.dmp

    Filesize

    672KB

  • memory/1456-18-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/1456-25-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/1456-31-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/1456-21-0x0000000002320000-0x00000000023C8000-memory.dmp

    Filesize

    672KB

  • memory/2356-0-0x0000000000350000-0x00000000003A1000-memory.dmp

    Filesize

    324KB

  • memory/2356-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2356-17-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2356-16-0x0000000000350000-0x00000000003A1000-memory.dmp

    Filesize

    324KB

  • memory/2356-15-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB