Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/06/2024, 08:44

240609-knmgwagc4s 3

09/06/2024, 08:31

240609-kexw9agb5x 7

Analysis

  • max time kernel
    74s
  • max time network
    78s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    09/06/2024, 08:31

General

  • Target

    @prvpane - X2 2020/▷ Necessary Downloads (for X2 to work)/VC_redist.x86.exe

  • Size

    13.1MB

  • MD5

    1fb0faba3d602afe03740db3d145c1e6

  • SHA1

    2c1ae47103e7f8d6072df4a8d9ceb382724ac59b

  • SHA256

    1acd8d5ea1cdc3eb2eb4c87be3ab28722d0825c15449e5c9ceef95d897de52fa

  • SHA512

    4509cfbd5f08cc32d68855edc285e8ba8caa7d2c4d044e4256dd907b205fda9a689c32ad7ef9ff3955e8390ed67498a54039a3cd4bfc9102ed82f9bd1255011a

  • SSDEEP

    196608:xRjxHvflpQcIIS/Rj7BWl+aV8t8z72BxBwBgO4Q/gVMMrXF/OMsjCEJy4ErENIhf:bxHHlptVYmfr7yBG/459OM+CC6T2sFb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\@prvpane - X2 2020\▷ Necessary Downloads (for X2 to work)\VC_redist.x86.exe
    "C:\Users\Admin\AppData\Local\Temp\@prvpane - X2 2020\▷ Necessary Downloads (for X2 to work)\VC_redist.x86.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\Temp\{007B19FB-7ED1-4203-87C0-08804BC0DADC}\.cr\VC_redist.x86.exe
      "C:\Windows\Temp\{007B19FB-7ED1-4203-87C0-08804BC0DADC}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\@prvpane - X2 2020\▷ Necessary Downloads (for X2 to work)\VC_redist.x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1628
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1616

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Temp\{B81BD038-5442-4EF7-9291-055F2CFFD5A9}\.ba\logo.png

      Filesize

      1KB

      MD5

      d6bd210f227442b3362493d046cea233

      SHA1

      ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

      SHA256

      335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

      SHA512

      464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

    • \Windows\Temp\{007B19FB-7ED1-4203-87C0-08804BC0DADC}\.cr\VC_redist.x86.exe

      Filesize

      632KB

      MD5

      1636039e4940c80acaeb369852f79cef

      SHA1

      7d2b5110d1bf729d7fcd9e42a2b01a58dcc66a69

      SHA256

      d116ecd1f04402430eb8ff5e07357f7ab2a2e0aa12dd6c5156e7f92705568e0e

      SHA512

      3ba5c3225b74594d6121a45f225204e8eb4b80afc60849fe78a933afcc81f8db7221cdcbe5789ade1b3f2d784dc3659c08692f7bd808b85198cb78e601d8da02

    • \Windows\Temp\{B81BD038-5442-4EF7-9291-055F2CFFD5A9}\.ba\wixstdba.dll

      Filesize

      191KB

      MD5

      eab9caf4277829abdf6223ec1efa0edd

      SHA1

      74862ecf349a9bedd32699f2a7a4e00b4727543d

      SHA256

      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

      SHA512

      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2