Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27/05/2024, 01:45

General

  • Target

    b3bcd4e5c084150f37c03f8a4cc9ce9693d246314bfb2d58f279a910cdaa46a0.exe

  • Size

    3.4MB

  • MD5

    0f51ec7c96b3aea6bc92fccf6d35d33a

  • SHA1

    23fbc7da031821c92a3b10d27af83659e2732bef

  • SHA256

    b3bcd4e5c084150f37c03f8a4cc9ce9693d246314bfb2d58f279a910cdaa46a0

  • SHA512

    8093fabed75e1932a83d9ee6b26ac2d63d26ebc447cb4334727585a4b0c70689634317acb92ee9a090175cc56079b1babef5aa5969077d27e5ada5bf127b7f3f

  • SSDEEP

    49152:t7Zi5hu7I/BzfK/ZHg1pHtOUYqP3CFOrtG/RR9sXafgkDFMVR9C1UhPJXMK701hi:NI5ht/BzfKW1t0xOouBiCV2Hw

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks for any installed AV software in registry 1 TTPs 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3bcd4e5c084150f37c03f8a4cc9ce9693d246314bfb2d58f279a910cdaa46a0.exe
    "C:\Users\Admin\AppData\Local\Temp\b3bcd4e5c084150f37c03f8a4cc9ce9693d246314bfb2d58f279a910cdaa46a0.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1636
    • \??\c:\users\admin\appdata\local\temp\b3bcd4e5c084150f37c03f8a4cc9ce9693d246314bfb2d58f279a910cdaa46a0.exe 
      c:\users\admin\appdata\local\temp\b3bcd4e5c084150f37c03f8a4cc9ce9693d246314bfb2d58f279a910cdaa46a0.exe 
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:2964
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2144
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2732
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2196
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2508
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2908
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:47 /f
              6⤵
              • Creates scheduled task(s)
              PID:1372
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:48 /f
              6⤵
              • Creates scheduled task(s)
              PID:2012
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:49 /f
              6⤵
              • Creates scheduled task(s)
              PID:2680
        • C:\Windows\Explorer.exe
          C:\Windows\Explorer.exe
          4⤵
            PID:296

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f5fdaa4df3a36023b18ba192f1ad22ab

      SHA1

      301ab1aa5c473ec3c1d1242312d7bc6cd9a4e7e1

      SHA256

      d803fa5c1eaa45c32a09c24cf4352e6088daff1c4b19d5abee2ebc330d478b38

      SHA512

      63ad71608059c1fe397abde4b6cdf50c7bb539041d46409ca566d734da064da962fcdd1f9389b4f44df628daf4f6e73970ce63a2b4132b92d781d9344251a84c

    • C:\Users\Admin\AppData\Local\Temp\Cab2DA7.tmp

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Local\Temp\Tar2DC9.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • C:\Windows\Resources\Themes\explorer.exe

      Filesize

      135KB

      MD5

      ccccd9754ffc5e2f4bd1ce3955366f11

      SHA1

      1e57f92b0a24d8750b178d0cd9af686ed3b9f728

      SHA256

      2b9a23b4224db60e44b4f6670d01878ee8f4d6e69362794278fac60dbd520d2e

      SHA512

      d52c6d549e8017f8e615ef35555e036b4c779f47044ecbf260b2e19508a0bdf503ef87f128b25b5079027a6adf6a50b53b67b2347a81332a2282a371886a9332

    • \Users\Admin\AppData\Local\Temp\Setup\ds.dll

      Filesize

      67KB

      MD5

      7d5d3e2fcfa5ff53f5ae075ed4327b18

      SHA1

      3905104d8f7ba88b3b34f4997f3948b3183953f6

      SHA256

      e1fb95609f2757ce74cb531a5cf59674e411ea0a262b758371d7236c191910c4

      SHA512

      e67683331bb32ea4b2c38405be7f516db6935f883a1e4ae02a1700f5f36462c31b593e07c6fe06d8c0cb1c20c9f40a507c9eae245667c89f989e32765a89f589

    • \Users\Admin\AppData\Local\Temp\b3bcd4e5c084150f37c03f8a4cc9ce9693d246314bfb2d58f279a910cdaa46a0.exe 

      Filesize

      3.3MB

      MD5

      7c2e5ef59e9589422bcd5bf3726fbcb1

      SHA1

      c4dac6966ac4cd3500d6a7fe44138a0db639d507

      SHA256

      6870e8dbcfaf543500add1d303de528c34e3b1f4d4424b0097c4ffb408a44fcd

      SHA512

      28870d9cb07f964ba0ecedfb25762cb4530bda869cc717dd4fffcd176085f03c05fd129b23e826dd6ac33ae6af8132bf9dc317ebffb52448b83236ad2349ca45

    • \Windows\Resources\Themes\icsys.icn.exe

      Filesize

      135KB

      MD5

      166f4152bd7ae24054f26a7c6f42bc55

      SHA1

      4853a1ffe4b68226038eefb0da4194553baa7a32

      SHA256

      8218bac4715775aacd67b699950e516ec7067cd2cba4f248572802639109f6eb

      SHA512

      cf73e62db1a4613fc58a401fc4d5c2fa98a193ccb2e1e788d839d5cee8cfda8c150bfd6f8c3a93f221dfee24c5a08962bf7b2b12796da7942db1223fb7cf7dbe

    • \Windows\Resources\spoolsv.exe

      Filesize

      135KB

      MD5

      d16aacfed72e6f0d3d20d840e9de6000

      SHA1

      5fdc6183a041697cdd775132a03831b0ff318a02

      SHA256

      ef0650608a010dbee06b987c7ec0bf7f5c23339e3e67a848e64bc6c160b1cc79

      SHA512

      b8720355309f59926ac01d7ca15d75ef12631c0810120fd6fb7ed664519e517996eeae8b8dcd6adc127d15745e5c959819a06254e9282030a7254828c5deab69

    • \Windows\Resources\svchost.exe

      Filesize

      135KB

      MD5

      eb136e4b74e04990b930439ad6cbb822

      SHA1

      2fb0dbbc5fa3c403b2dafbbe03e84251e1d82d67

      SHA256

      a73a70facc42ad44e97358c1755b99af4bc4ab61ad7d168d847755115eaa74d6

      SHA512

      abe734ecfa0b6a5401623d20690010006e295f50a321da5d462e7e45993ef902f72bc5cc4518981fadd3e4cbd636f88dfb1cd50da25e7126265e43c18e22ada2

    • memory/1636-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1636-16-0x00000000002F0000-0x000000000030F000-memory.dmp

      Filesize

      124KB

    • memory/1636-77-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2144-31-0x00000000007A0000-0x00000000007BF000-memory.dmp

      Filesize

      124KB

    • memory/2144-17-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2144-76-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2196-57-0x0000000000330000-0x000000000034F000-memory.dmp

      Filesize

      124KB

    • memory/2196-75-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2908-74-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2964-63-0x0000000002A00000-0x0000000002A14000-memory.dmp

      Filesize

      80KB

    • memory/2964-64-0x00000000746B0000-0x00000000746C4000-memory.dmp

      Filesize

      80KB

    • memory/2964-38-0x0000000002830000-0x0000000002870000-memory.dmp

      Filesize

      256KB

    • memory/2964-198-0x0000000003340000-0x0000000003384000-memory.dmp

      Filesize

      272KB

    • memory/2964-200-0x0000000004310000-0x000000000432F000-memory.dmp

      Filesize

      124KB

    • memory/2964-199-0x0000000004310000-0x000000000432F000-memory.dmp

      Filesize

      124KB

    • memory/2964-201-0x0000000002830000-0x0000000002870000-memory.dmp

      Filesize

      256KB