Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

dee0fe99bf...d0.exe

windows7-x64

8

dee0fe99bf...d0.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    10/07/2024, 05:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dee0fe99bf53a404bf162cfd239d22425390ea6eeee16faf2bf3457e467743d0.exe

  • Size

    24KB

  • MD5

    5514470f8edb4733f119fbb6d441e002

  • SHA1

    406eb68234149df1aac1c9d611f3bf14231f0e5f

  • SHA256

    dee0fe99bf53a404bf162cfd239d22425390ea6eeee16faf2bf3457e467743d0

  • SHA512

    84df5103f760a317d8c5de0527e65cab673fcae9ec1f03977ab1f772895fb761c54e9b04c07d82c3a9011fc3867ba975a1bf7f3cef17c72ae9eab615e4e6cb65

  • SSDEEP

    384:CxL+q5r+PpHfXhUkKvI4QwjQ/vFJhheJ06oZrj/vBKDJZ4:ua4r+PpHfXGLOnNh8noR+K

Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 60 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 7 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops desktop.ini file(s) 64 IoCs
  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dee0fe99bf53a404bf162cfd239d22425390ea6eeee16faf2bf3457e467743d0.exe
    "C:\Users\Admin\AppData\Local\Temp\dee0fe99bf53a404bf162cfd239d22425390ea6eeee16faf2bf3457e467743d0.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Windows\AE 0124 BE.gif
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:812
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops autorun.inf file
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1324
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    81b9a6685519c901780f86ce2d55f2e0

    SHA1

    cfecd482124d826b0175ab85c42d74e71b021ebe

    SHA256

    336f665ed878c31d4b5551abb297c35047835bd03d0d19324a8b2af65ec2d33e

    SHA512

    9a91386178519f407d6ef7f1c4bf48ade135b634f2b43bc3d891394a2df47b7226136dee26e2479f0d5a0a2cc6cb43fa707c606e9a2e5183e7f47357dd917eda

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    042754044a1504449326dde16761e707

    SHA1

    88f87387fe8cd9147c6c0ec1c81012ee54108631

    SHA256

    27d3d5c026dd2fde6cca182ebd1e252c10a6f7c643e80c98b501e8d769677eaf

    SHA512

    33cc2bb963745a991f54f3ff0eafeded334b1e1d24e380c9b18c6138f1a642ca553a1314674625c89ec1ef4b390b50198ea494e43e33c371f3d51b6f9155bc70

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    6cff25b10758bb568b52faa12fbf2bc1

    SHA1

    6d9e0544759e26068eaaf72521d505c2911e9ce7

    SHA256

    4f1c07d5d0d53fdb74a2ceda2f26679f75664fc0bb7764e132604601514574d0

    SHA512

    f7a9869367567c25c9ecc89182073dd6e13eaa5ff5d5c78004b877f69595e816fc79331f86519e7100205301d74a2246ccb8ee4190c495e97790b9ce5dd69954

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    4fef310005d3e486f1100310e9fd3629

    SHA1

    b261413a3b8aa0bddfd3f02d177441e4b2a904ea

    SHA256

    5a4ba65cf0d05ff47cfe567e01d1789fe3fcbbbef4ecb47e7b927de6aeaa9b69

    SHA512

    353e3ffda2df184204b9409279b3a1f12c6c55b57e461487f5dca568f6a5a73e6f4977035254d44c7b3d29bc2f442a7680cf07a866c7462534d995b03f38ce5c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9c0f903a481efcdf198abb69b528a252

    SHA1

    cae7ca96717bc8147ccf684b98c15ecba2fa4157

    SHA256

    0a3d067834827b65f47860f3500fcb155ebfe8653f3e1da9e6297e7ee3955ca8

    SHA512

    4da7fc4fbb90fc41f06b98ffbd9a484a721847ba374fbd8d3ea45564a24f05a756360231f8717458577eddab60be94e359b0113f692fcfbeaeecf0ee8a5e1b3b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    b2845b95d8f74443d9570666ef79c5a9

    SHA1

    2d1d39703e476cc9cb3f480629ca8d188d076852

    SHA256

    459f8eb33dafd66b06437aecd494bb26080211cf6e19f5d26219fd9d31ca031d

    SHA512

    df0ee42ad1c2cb145da1f7b72656a247435234ca026f6c571543cc7c45536f89684973c6b61cd5eea9e1338fb63a099490b204a63fbae000344a3eb7b4aac18d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    678fa3a6f170dabf27d0e87326a7d767

    SHA1

    38dd707cb9de74b86d26e057c2eb240ce766d2e0

    SHA256

    15acd67784fdbb395b828e20e46941ec1a6f38e4b6093b29f59b675155004bf6

    SHA512

    db317f4f637722c556a7bfd18abb3da5be82b736019522668563b8b483ec521fd45f9ddca2dd702f430fef7a7d23d4aef58fd9a15e3ed2596b815bbb27f50dcd

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    d742ae3a9df1336446c260da2fc50ca5

    SHA1

    59037eb3ef7bd078c5cdfd60921420e18be216e8

    SHA256

    efabc2139935131143b2a7d5f984e5608820bc083daa9cadbf2529313f81519e

    SHA512

    0ee5e2e32079098e6aaf2794ffd101cd689fb9ea8dfe9a1f2a18d08d4d9ad12c5bbd4af244c7f7c835d1f785ae18e416b53de91283f85dc93abb4fa70d15a874

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    8633cee9cf4af3ffb55404db8f187f66

    SHA1

    c16724e8707c6ca7f5bb6e00bab7357df0126eaf

    SHA256

    cb7ae3c30dd76f66b4522b54250700c807eef8bbb255116d065136a8482b99ee

    SHA512

    0f089f564e31fdd77a96b35cbb57ee4ef8728cc6f5771830c5ef1e6e411989bf286667ac095633b2794c656175372f676ec81b4d313b4a9ff29c19491757825c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    51bb66f1fe45090416f0510ef5e699ed

    SHA1

    26ec975e42f095e36b71e8e2a61e36142ec0bb1c

    SHA256

    c98f6548f081c27498589120b44dc49a3edca0fb5c9f03a2320c48c5624ad516

    SHA512

    f1dfd5b62225a864999e1684b3873120915b1c2c6c60ea37e746840a2a100587dc092f732504c28d0e0361bbfc5cbba295327cfc095bea8a447f64d4df4da285

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    bd810d30912a1b5bc541b94370b39cdb

    SHA1

    0333d763a0991b7f088a66a0f5258e75bb89e512

    SHA256

    6bc5fe330e7a53a309ff4e49687b946b39989067153dc0fe5e134ced1238b728

    SHA512

    7fd0736ff065ff804664ab24425c007f9ee14f3ffc1de8a509edbe6804351a2c4300b99274e1fcaa9b595bef0e743a17b89a90eb18ee09704b4957b1d843f37c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    bb1598dfe087908a95fa0c1d778ae80c

    SHA1

    847ce7fff596bec85641df4b264658344d0f5e34

    SHA256

    f72ce917ab6202abc49e5ec58186af39c9b46983884076e956a11929ff27adc1

    SHA512

    c2b66dc848b8d8f2bec64c25eb7b1e963cd842e248c2d68eeebeb1bdd9d3d9c44b0d6edca2f8c5547a7cdd9b0588cef68e84fea1929a602808e5dd0bb20038cd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabD146.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarD5FB.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\AE 0124 BE.gif
    Filesize

    24KB

    MD5

    4c420efb5050d85147cdf9e19fb09269

    SHA1

    1ceb3f87939ee2b7c2972b524101a64830a34040

    SHA256

    d2813c5770b95a90239267e472aa1f0f8274474d75b4d5f768ad6177d2c017bb

    SHA512

    36c5e48a2dd28742f326e72ee264f7cd6872a56e2f0d2e0459a48d95fff9d98b88e55944186433677c0f4d9e2259400dc8f0821b2116686342a3234c2b778a18

    Download Submit

  • C:\Windows\AE 0124 BE.gif
    Filesize

    48KB

    MD5

    30fe7061613ec6b676a971ad2de288b5

    SHA1

    ed4ce7635cc39c790416f9f1220913cd1f41b31c

    SHA256

    dcff1eaa13380f4bd39088699d082f5057ef2b5f5a6482726a3c9307e27248c4

    SHA512

    9214d9451cc9da1137e4f93576cb843bac61bc1c21cbc7f0d8777181fe5b784a2c5bc0e69e2134b57cc35789220a31bc1b29a9b096e33a3016d13b165786cfc3

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    21B

    MD5

    9cceaa243c5d161e1ce41c7dad1903dd

    SHA1

    e3da72675df53fffa781d4377d1d62116eafb35b

    SHA256

    814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

    SHA512

    af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

    Download Submit

  • \Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    48KB

    MD5

    7dc8becf5c877be2df5b6ab3d8e06cdc

    SHA1

    d220501f203b654e4f72ded21997a8f0a42e4435

    SHA256

    4ccb4888118f2fe7b889e3c33c28f7011d6c5bfc806e5bde1b991eb16eea87b3

    SHA512

    4c488ead12d12c1f5ae0637aec76beb8cc64f0d4daeb18a6914236c90aef33653aa97dec0e79c7cff8abb6afd9ca6cd32c513017f5c77b27841e02e96434163b

    Download Submit

  • memory/1324-62-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1736-12-0x0000000002480000-0x0000000002487000-memory.dmp

    Filesize

    28KB

    Download

  • memory/1736-60-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1736-13-0x0000000003820000-0x0000000003C2B000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/1736-18-0x0000000003DC0000-0x0000000003DCB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1736-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2704-77-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2736-783-0x0000000003700000-0x000000000370B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2736-782-0x0000000003700000-0x000000000370B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2736-1228-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2736-57-0x0000000003700000-0x000000000370B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2736-780-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2736-58-0x0000000003700000-0x000000000370B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2736-669-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2736-1227-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2832-72-0x0000000003330000-0x000000000333B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2832-785-0x0000000003330000-0x000000000333B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2832-784-0x0000000003330000-0x000000000333B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2832-778-0x00000000024E0000-0x00000000024EB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2832-779-0x00000000024E0000-0x00000000024EB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2832-36-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2832-73-0x0000000003330000-0x000000000333B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2832-45-0x00000000024E0000-0x00000000024EB000-memory.dmp

    Filesize

    44KB

    Download