Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

19adcf647f...00.exe

windows7-x64

8

19adcf647f...00.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    05/07/2024, 19:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    19adcf647fef49febc7c22c5483ac2f22dc818c11eb110b96e92e9076f5ee100.exe

  • Size

    119KB

  • MD5

    09c9849a09105524828f1802f2370bf4

  • SHA1

    c2bcdce91b0b4e32bdd0b3d9b709520c9dcc1554

  • SHA256

    19adcf647fef49febc7c22c5483ac2f22dc818c11eb110b96e92e9076f5ee100

  • SHA512

    18c6ca481cc365da0d148c53e0b8db6295ee8bfb8b55287d277bd54d9950ce3bffbd558dc267f0574c0fc8a398818a7575976dde5b3c664a359f02f905b1d8b3

  • SSDEEP

    3072:AOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:AIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19adcf647fef49febc7c22c5483ac2f22dc818c11eb110b96e92e9076f5ee100.exe
    "C:\Users\Admin\AppData\Local\Temp\19adcf647fef49febc7c22c5483ac2f22dc818c11eb110b96e92e9076f5ee100.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    97d75b21b9364d6297d0d9128ee72fec

    SHA1

    f17142a3383a4b7c9acadcd748bd3f31d9cfc669

    SHA256

    6ae2dfb9e82dc7e3fae6d992cc083a0b7494e9809f9e0a2e67f6d88f11ac5263

    SHA512

    a9170dab48a245e3157b543de83fc73093a81ce0405a60ed3566129bbe14660e6715294dd98702e59fa7e29fee2cee23ddaeaefb620afe39461f03c1d1c712ee

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    65a9e3c555d481fb7e957f698aafc7f7

    SHA1

    e3c37494340bfb347bd9892fff6e93c4c4b0b5a4

    SHA256

    1d8da9549c9220a726c099b744679134892758a67cc75d0dca7dc142bc5ee921

    SHA512

    ef85c25c6dc3e81bebb7b13c7b3b693f136be392928341fa35d8361b13b5bf159539ba338e27205fc34ef0b15c1c420333ec847f02e1561ec2481b9e99effae3

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    fdf8ffd04d5a0f90a40d39d9daf46bca

    SHA1

    e79fb921f95ab12ac831eda84075f3c850a2a5fa

    SHA256

    e53453d7da436a682c6aa835fe9a55e9df15d5445df201255651028b0f712e4a

    SHA512

    c2eab6a57c088460709703873b3bcc785893d807804bf0efde2bf2ac1f1afb50403f34834923ecd1a3e7a34ad0c785853abc61fc7dd396baa2a7e63e20744a37

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    119KB

    MD5

    34d7e8864621a92d4276606565d85c8f

    SHA1

    2da867c51e1f9abb1283af07edfe1fb3e0fb06de

    SHA256

    fc8c9168dda0b92d1f9d8a5365f60864220fd53d4f96b5b7bc1d947a2aaf9978

    SHA512

    29bb6a9cc1b61e110c7c7600244b8f7b590a61f8d258c775fffbb161b372d78f9f92c0c8cbd242094771f1d7b1524f51931c1a67349f423c73a55937f60bf537

    Download Submit

  • memory/2812-26-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2812-27-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2812-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2812-20-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2812-16-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2984-34-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2984-41-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2984-44-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2988-32-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download