Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 18:24

General

  • Target

  • Size

    190KB

  • MD5

    248aadd395ffa7ffb1670392a9398454

  • SHA1

    c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5

  • SHA256

    51290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc

  • SHA512

    582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e

  • SSDEEP

    3072:15TDpNFVbxDSXJFFGhcBR1WLZ37p73G8Wn7GlDOg+ELqdSxo5XtIZjnvxRJgghaR:157TcfFPB6B3GL7g+me5aZjn5VlI9T/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2180
    • C:\Users\Admin\AppData\Local\6AdwCleaner.exe
      "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    95eb63ef76e9828e364e316791715437

    SHA1

    f72dd5cfb379c85aa69944981cf6d10e2d6def7f

    SHA256

    2c7a1e8031757e6311469234d41037baf79d3815adad8f9a70e7654949ca20e6

    SHA512

    9b91a53cd26bc6dbc1a87120c3e820a9971b6c5473b6ca7f2491fa114a00587aef318b4b3ddfe2646b444da9727bf4d117ec2b3dc2b54a05bc41f139360874aa

  • C:\Users\Admin\AppData\Local\Temp\Tar3171.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\6AdwCleaner.exe

    Filesize

    168KB

    MD5

    87e4959fefec297ebbf42de79b5c88f6

    SHA1

    eba50d6b266b527025cd624003799bdda9a6bc86

    SHA256

    4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

    SHA512

    232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

  • memory/1704-9-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

    Filesize

    9.9MB

  • memory/1704-6-0x000007FEF5A83000-0x000007FEF5A84000-memory.dmp

    Filesize

    4KB

  • memory/1704-12-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

    Filesize

    9.9MB

  • memory/1704-13-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

    Filesize

    9.9MB

  • memory/1704-10-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

    Filesize

    9.9MB

  • memory/1704-8-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

    Filesize

    9.9MB

  • memory/1704-7-0x0000000000370000-0x000000000039E000-memory.dmp

    Filesize

    184KB

  • memory/1704-11-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

    Filesize

    9.9MB

  • memory/1704-121-0x000007FEF5A83000-0x000007FEF5A84000-memory.dmp

    Filesize

    4KB

  • memory/1704-122-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

    Filesize

    9.9MB

  • memory/1704-123-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

    Filesize

    9.9MB

  • memory/1704-124-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

    Filesize

    9.9MB

  • memory/1704-125-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

    Filesize

    9.9MB

  • memory/1704-126-0x000007FEF5A80000-0x000007FEF646C000-memory.dmp

    Filesize

    9.9MB