Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 23:22

General

  • Target

    717ecce3057adfe6d40172158d6334a0177064d24fea6b3b78481a8c5ee4076a.exe

  • Size

    7.2MB

  • MD5

    68039ea285456b07636828f963515e22

  • SHA1

    d0a086a3dc0cdf1eb05219f909a4cd234c57dfd5

  • SHA256

    717ecce3057adfe6d40172158d6334a0177064d24fea6b3b78481a8c5ee4076a

  • SHA512

    184fdae7214d880573519be8b8b0a0aa84de5714093fb036757f994a98163e432eaed1ccf7797fda25c446fc168c37b6d756cc1ec374669e3721c645aeb0188a

  • SSDEEP

    98304:47O82rQfXHndMdQIvJ0Cd/C5jKRbAlAQAzNwpUJx4O875RjfxIrfvoYJMZx68owi:4CQP6QUJ0s/CWAOpWi6RrxYvD+68owi

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 27 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\717ecce3057adfe6d40172158d6334a0177064d24fea6b3b78481a8c5ee4076a.exe
    "C:\Users\Admin\AppData\Local\Temp\717ecce3057adfe6d40172158d6334a0177064d24fea6b3b78481a8c5ee4076a.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2556
    • C:\Users\Admin\AppData\Local\Temp\xl.exe
      C:\Users\Admin\AppData\Local\Temp\xl.exe
      2⤵
      • Executes dropped EXE
      PID:2596
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c wmic BASEBOARD get Manufacturer/value
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic BASEBOARD get Manufacturer/value
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2136
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c wmic BASEBOARD get product/value
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:788
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic BASEBOARD get product/value
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:480
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c wmic cpu get name/value
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1420
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic cpu get name/value
        3⤵
          PID:1516
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c wmic Path Win32_DisplayConfiguration get DeviceName/value
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2324
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic Path Win32_DisplayConfiguration get DeviceName/value
          3⤵
            PID:2120
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c wmic Path Win32_DisplayConfiguration get DriverVersion/value
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:864
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic Path Win32_DisplayConfiguration get DriverVersion/value
            3⤵
              PID:1948
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c wmic SOUNDDEV get Name/value
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2456
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic SOUNDDEV get Name/value
              3⤵
                PID:2416

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\gonggao.html

            Filesize

            427B

            MD5

            d4f2205ab045a47877764f78840ab40c

            SHA1

            cb8b63d9c7f68026088517e98f6ca04cfecaba0f

            SHA256

            6e70857d2726ad583f9fe6373532fa27235a4736aaa2a8ee890c996d83f5b65f

            SHA512

            358d80377a3b58beedde8c4c3ef0918cd24ee5eab39df310e4621eefdde79c6c49a5da5e699a06c5f22b157f85d163bccdf79748ac67e3a2c56c6a36c7b717f1

          • F:\CNGHO\CNXT.cai

            Filesize

            82B

            MD5

            313e9dea853ec6718438256b524b665d

            SHA1

            0ee11aa0b0f829a2eae8d33268caaff945ced5cb

            SHA256

            34c613693709fc4deb729d77b0a21d64a8db00c2d889fa55bb3bcdb975c67e47

            SHA512

            b2a85fdeaeed438643558d744fc8e600937de4cfd6342d21b154facb1b175ad99dab67a03cbb86aafabccfd4ce9b724da550d65dedbab706acc8776e63868fa1

          • \Users\Admin\AppData\Local\Temp\xl.exe

            Filesize

            2.2MB

            MD5

            a1e1b658a9dc29cc30d0371e9fa94e12

            SHA1

            a56a24fe5245643af3ec9a12875d59dd44e6d5fa

            SHA256

            7c7b24362e3529bbaa540b9885bd4922ccfa85951054af5aa610f6cbe415bb45

            SHA512

            f38f47608deb58fcba0f5639632651df76983e169cf752c8b03313cb46bdacb4d9d5285580ac3244c6a4584da69e2bb61c8897de82aa60026bc21d92bf60b807

          • memory/2556-39-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-33-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-6-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-15-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-13-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-11-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-35-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-45-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-48-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-43-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-41-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-1-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-37-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-7-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-31-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-29-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-27-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-25-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-23-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-21-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-19-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-17-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-9-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-4-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-5-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-3-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB

          • memory/2556-116-0x0000000010000000-0x000000001003E000-memory.dmp

            Filesize

            248KB