Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    12/06/2024, 04:17

General

  • Target

    cb2d34626b89ea865e1e4ca57525fbdeca359aeea19246d646e58b1317269b67.exe

  • Size

    218KB

  • MD5

    76bf977884957ff1624a9c8e6825b27c

  • SHA1

    c71ca66fbed01dc42f9473feeb85d52371f11b09

  • SHA256

    cb2d34626b89ea865e1e4ca57525fbdeca359aeea19246d646e58b1317269b67

  • SHA512

    c27310eee7d80625bd1f802a46137052b842b503d9ee73aac29c632b872718f94d4cc4c5f64b55ebbcc9e1582f46942ae899c4fa45e6efc9adfa41cff2e25d58

  • SSDEEP

    3072:Hvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:P1SyAJp6rjn1gOObn4b6h9h

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb2d34626b89ea865e1e4ca57525fbdeca359aeea19246d646e58b1317269b67.exe
    "C:\Users\Admin\AppData\Local\Temp\cb2d34626b89ea865e1e4ca57525fbdeca359aeea19246d646e58b1317269b67.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:816
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6F0O117Z\login[1].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Temp\1817.tmp

    Filesize

    2KB

    MD5

    ab56e552960041ab19113d13837bc24a

    SHA1

    ca34a1e6168b23f3ab91a11c8ac04ae9c551d39c

    SHA256

    6917dec5bc92dfae5322d2d1cf264655b7ee46dd189884213551905f26984b4b

    SHA512

    1320ab72b08160dc6d72e979d9395d41b678ca42accf34efedb4f1d263d9f056fab0aaf06c8cbc7871620e79a687bb47d5b41fd0b2ed472e372d1335c31c5747

  • C:\Users\Admin\AppData\Local\Temp\9351.tmp

    Filesize

    42KB

    MD5

    28f5aefba0335ba1f58f50e1f1ddeed5

    SHA1

    75fa3a9acc7f2730bd97c52ee62d8600de72fd70

    SHA256

    956ef274ce844fc76299d01af5aef2d98f83cd234d7dbcde7ca61e6b80b997a3

    SHA512

    ad5fac6276aa46810ab24eb3f04f5b119a076457a21d240eb5bcb59136d775ec15810865a83f772c2a1bc19005947df2738f25a2d4a5bcdf00398b17e2fe60e1

  • C:\Users\Admin\AppData\Local\Temp\9351.tmp

    Filesize

    42KB

    MD5

    1633107aa5e7f9b0f9a67e6203e0e7e3

    SHA1

    02fd120485d46ebb8b2bd94e58483fae1b537d49

    SHA256

    716094b6e9c673bf2981c775cf127359072899e934fa3cf00a5fe0867a6e5b7f

    SHA512

    0d2a11186414ccc644f4521578bb7d547d1d12c0af103f870b4a9422a00fa4adceedcd4aca0e7726b207ca034b641bd506153391aa3a48c5bd340738372ea1d8

  • C:\Users\Admin\AppData\Local\Temp\CE6A.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\CFB7.tmp

    Filesize

    457B

    MD5

    531ec87a0b2f9477a52d88b111d0d46a

    SHA1

    50a72e5752075309f91c062e0282a7e7cd1e751e

    SHA256

    4875b451859b1eb8d0d3b040b1bb8d654d212edb6d9c721cf0f4372129579385

    SHA512

    07994963fd76b31ef0ba2c7f418dcb3ee0290f6baca2d8ec63a6e6b861557b13fbc20d2f0a10a66f35c4d72d4d2c1920ac88b96174604f2f8856868912327da1

  • C:\Users\Admin\AppData\Local\Temp\Cab80B8.tmp

    Filesize

    67KB

    MD5

    2d3dcf90f6c99f47e7593ea250c9e749

    SHA1

    51be82be4a272669983313565b4940d4b1385237

    SHA256

    8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

    SHA512

    9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

  • C:\Users\Admin\AppData\Local\Temp\Tar81C8.tmp

    Filesize

    160KB

    MD5

    7186ad693b8ad9444401bd9bcd2217c2

    SHA1

    5c28ca10a650f6026b0df4737078fa4197f3bac1

    SHA256

    9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed

    SHA512

    135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

  • \Windows\AppPatch\svchost.exe

    Filesize

    218KB

    MD5

    955f15ae53d8dca4bb4a1926f5f8cddf

    SHA1

    c21377c08af721dd737908eda2e7b8c60600664b

    SHA256

    57df6c8e3f3b3143aef3f48e2cfea8bf0bec53d095fe059004329dfd8b7309b9

    SHA512

    55772f9c59f5caf2da99ee353a3412ae4e0849c45b34c4682afc805b1da51facc4fc0fb47ed4504070c465d47669bb53d565de8872fb1f773b7aace05f22326f

  • memory/816-15-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/816-16-0x0000000000220000-0x0000000000271000-memory.dmp

    Filesize

    324KB

  • memory/816-17-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/816-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/816-0-0x0000000000220000-0x0000000000271000-memory.dmp

    Filesize

    324KB

  • memory/2840-68-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-61-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-21-0x0000000002370000-0x0000000002418000-memory.dmp

    Filesize

    672KB

  • memory/2840-30-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/2840-32-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-34-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-36-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-46-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-84-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-83-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-82-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-80-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-79-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-78-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-77-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-76-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-75-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-74-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-73-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-72-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-70-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-69-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-25-0x0000000002370000-0x0000000002418000-memory.dmp

    Filesize

    672KB

  • memory/2840-67-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-66-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-65-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-64-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-63-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-62-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-23-0x0000000002370000-0x0000000002418000-memory.dmp

    Filesize

    672KB

  • memory/2840-60-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-59-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-58-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-57-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-55-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-54-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-53-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-52-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-51-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-50-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-49-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-48-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-47-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-45-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-81-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-44-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-71-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-43-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-42-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-56-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-41-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-31-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/2840-29-0x0000000002370000-0x0000000002418000-memory.dmp

    Filesize

    672KB

  • memory/2840-27-0x0000000002370000-0x0000000002418000-memory.dmp

    Filesize

    672KB

  • memory/2840-19-0x0000000002370000-0x0000000002418000-memory.dmp

    Filesize

    672KB

  • memory/2840-18-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/2840-40-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-38-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB

  • memory/2840-39-0x0000000002520000-0x00000000025D6000-memory.dmp

    Filesize

    728KB