Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2024, 22:22

General

  • Target

    1ce476f82cee74231401b37a99650d40N.exe

  • Size

    211KB

  • MD5

    1ce476f82cee74231401b37a99650d40

  • SHA1

    1208512288024ca2661eecd11f83ad171eca1588

  • SHA256

    a5666de35d8333c1a91281efffa6eab92820850336566bb3de258ce9814d3891

  • SHA512

    0b770f9e5e05fb9ee47cd7dada684736c8c074a2b55f64a1f174db11082e1370a94fa63f884c7aaa83537c100c01e0a901ac5ed635e54dcbca7e46b1ecd92470

  • SSDEEP

    6144:gmKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3:q71YpQiU/RcO1VQInVob

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 1 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ce476f82cee74231401b37a99650d40N.exe
    "C:\Users\Admin\AppData\Local\Temp\1ce476f82cee74231401b37a99650d40N.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b06f75691f9efeca6e2e9263f1c7e4bf

    SHA1

    ef7038cc0faf7f26819be5fb6abdbc256b6d071f

    SHA256

    8c36838c871624b7a00b4ae8fdd381160111cc9dc890a0c04646252f982510de

    SHA512

    13642d85f8e47191c768a0b297e06965dd058fff6d1e2dd3c1ff303fb1a3eb460e2049bc776e13764dd80b94156af48877edb1b0883eeb41b9c70bbf040fc000

  • C:\Users\Admin\AppData\LocalLow\Temp\CabECE2.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Temp\TarEDE0.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\35L2VNYM\login[1].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Windows\AppPatch\svchost.exe

    Filesize

    211KB

    MD5

    9604bf19ce17ee0a0cd4515585b713ac

    SHA1

    9df2ac78236fbfeb56d7eb532c292b4cdbdc180e

    SHA256

    c037935500be6fe3f10d0a376239be66dd2eec5d3ea22a73af5c22a6084884ff

    SHA512

    63bcbb9d0ee2bfb14d96e6afcbae568f7c6816aa10fd1cc8420e99943bac18f29f4eeb0329d58a4e74a8ecaeb572a2f6a21e220a77d15992a96bf1d3d88b62d9

  • memory/832-0-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/832-1-0x0000000000290000-0x00000000002E2000-memory.dmp

    Filesize

    328KB

  • memory/832-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/832-18-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/832-20-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/832-19-0x0000000000290000-0x00000000002E2000-memory.dmp

    Filesize

    328KB

  • memory/2108-75-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-69-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-27-0x0000000001D00000-0x0000000001DAA000-memory.dmp

    Filesize

    680KB

  • memory/2108-34-0x0000000001D00000-0x0000000001DAA000-memory.dmp

    Filesize

    680KB

  • memory/2108-32-0x0000000001D00000-0x0000000001DAA000-memory.dmp

    Filesize

    680KB

  • memory/2108-35-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2108-30-0x0000000001D00000-0x0000000001DAA000-memory.dmp

    Filesize

    680KB

  • memory/2108-28-0x0000000001D00000-0x0000000001DAA000-memory.dmp

    Filesize

    680KB

  • memory/2108-24-0x0000000001D00000-0x0000000001DAA000-memory.dmp

    Filesize

    680KB

  • memory/2108-40-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-38-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-36-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-51-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-77-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-86-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-85-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-84-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-83-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-82-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-81-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-80-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-79-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-76-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-22-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2108-74-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-73-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-72-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-71-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-70-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-23-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2108-68-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-67-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-66-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-65-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-64-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-63-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-62-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-61-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-60-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-59-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-58-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-57-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-56-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-55-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-54-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-53-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-78-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-50-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-49-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-48-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-47-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-46-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-45-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-44-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-21-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2108-43-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-52-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB

  • memory/2108-42-0x00000000022A0000-0x0000000002357000-memory.dmp

    Filesize

    732KB