Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 22:16

General

  • Target

    629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe

  • Size

    126KB

  • MD5

    1a73de756775fa022c8c9251c4321f8e

  • SHA1

    7b0b30308e6aa293f932bdd960fa4d766a7ba89a

  • SHA256

    629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e

  • SHA512

    5552cf2565ec11c3416c735860665df75aeabaf4652c63d1ae9389b13197ca995a4cd7ebe654c9572be49f8a674e80900aca49f79b8bce07a0b4400e4e96891c

  • SSDEEP

    3072:jEboFVlGAvwsgbpvYfMTc72L10fPsout6S:gBzsgbpvnTcyOPsoS6S

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 25 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe
    "C:\Users\Admin\AppData\Local\Temp\629be216e8fc635bf13be6b999c29b89c4827152397b7a0f300db8759f64724e.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
      C:\Windows\System32\wbem\WmiPrvSE.exe -EMBEDDING 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840 0
      2⤵
      • Deletes itself
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2796
  • C:\Windows\system32\cmd.exe
    cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg
      "C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1896
  • C:\Windows\system32\cmd.exe
    cmd.exe /c call "C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg
      "C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg" -3 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\System32\svchost.exe -sys 423B5D51736E6673606C2147686D64725D426E6C6C6E6F2147686D64725D4C6862736E726E6775215269607364655D4C52486F676E5D304530304230475D474A422F565840 0
        3⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\1D11C1F123.IMD

    Filesize

    127KB

    MD5

    8d4ac7ffcf439607d17574a604890e70

    SHA1

    c812324bc4956b3dbc2dd9b36f7290c2e0e9f9a3

    SHA256

    f862f6daab8b1147c12c6a6b8bac84932e702a4d0f6b0bf050f5970085fd7861

    SHA512

    bcccef35517d5889f7e531aea0e74bbba5f76ad06ba16bd34e28693ffbeb193fec620bcd5a06d370814efea325bb438b4c9fe9314af4e9f57a9b3fa19afb4cfc

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\FKC.WYA

    Filesize

    108KB

    MD5

    f697e0c5c1d34f00d1700d6d549d4811

    SHA1

    f50a99377a7419185fc269bb4d12954ca42b8589

    SHA256

    1eacebb614305a9806113545be7b23cf14ce7e761ccf634510a7f1c0cfb6cd16

    SHA512

    d5f35672f208ebbe306beeb55dadde96aa330780e2ea84b45d3fa6af41369e357412d82978df74038f2d27dff4d06905fd0b4d852b0beef1bcfdd6a0849bc202

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIF.jpg

    Filesize

    126KB

    MD5

    a75bec01179a4011ea8e5372e63fc5f4

    SHA1

    ead32741514fd4ca6391240b3e7c24ee9d2e414f

    SHA256

    72584ffcf77cf86cc6820881dea33ff2ce70c0d15e3c447b99c199d8fb2009b4

    SHA512

    0019bea4335ae81237b9d2ee2b9cff9189a84f5a60e7faf8577ab67dfa009ef50d4697e6c7caeb8dec52d1fef9151c31dbf850d4c7406f9e544bc0da8c406798

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFmain.ini

    Filesize

    843B

    MD5

    11b38f0c6f553536ff74739ac23453de

    SHA1

    211f7a22e4466f4df5aa77211beb57d573b95709

    SHA256

    8ec48a8b83587fac06c348cf682693f9db3bbd7874e8ab94dcf4e6bbc0ab43d7

    SHA512

    a7d6a6d589a5e0d159b1c4a81e26afa56fcf4cf7f0d4cf143d150e7544805bfd47fbee5c7e5b74d32e8587ec359fb6264840c1e35c44df9a5774e38636169636

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\KVEIFss1.ini

    Filesize

    22B

    MD5

    2056c975629bc764596c2ba68ab3c6da

    SHA1

    35e3da93ce68d24c687e8c972f8fa2b903be75b8

    SHA256

    8485a6ec9ad79a1ed2331a428944711c4064f0c607017dae51c7e7f65fe70ff7

    SHA512

    c4d4932e81956578e505ac454d964ccd1d7d123e8393d532db15ba42e456ceff8394baba021e8ae7ae2f9aef0e51840aecef12252cf9c6766e8b247eb08e86ae

  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\1D11C1F\ok.txt

    Filesize

    104B

    MD5

    88e40d783f03a9e855d9d20eb269f6ad

    SHA1

    771c3e4a6355cfba3bb51a1af953b3273e9cf05f

    SHA256

    e1dcbd08aad543693a18973e233ad53a9f2eab2e15413d5110b64e0bed49a9bd

    SHA512

    480a9885d21fa7957ff89171965b6b7f35fd720d2d65aecb37d1a8eae1e21735867f7cebb867c8d7bad427c16f3cf15cbd1f6892c4bab0226919588849cf27b3

  • C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg

    Filesize

    126KB

    MD5

    41d4eab6f3b2f0c9f42a93252185c7f3

    SHA1

    0b6d597f1701e3849ed8ce9539d16fa83a663f84

    SHA256

    599946259944003b60473b346b22a0813ff5424f5032e968bddde2ec63c6ef32

    SHA512

    a203ba2a9334d0eae36b90ac95d9802049b415a2a256233c59149198350d2f48f2fec0becca2ef37b4a16f8020749f35b6ea79a9ddffbc0fc48cd1f006737c52

  • C:\Program Files\Common Files\Microsoft\1D11C1F\KVEIF.jpg

    Filesize

    126KB

    MD5

    e87edbfe1a1a9ce4a8e31bc30c957005

    SHA1

    796f82d3bde86185b5d041a768a77dcf0b91c260

    SHA256

    1081e48e42548597b84f6f9051a3ef32624643acbd4039b9df89c784bc395f66

    SHA512

    1de93c927c4f1bd0dac000ccd76365b74146e09b45e8c86e5c0950946a3f7056125d0cfc744109ceef4f6d4c6675a0d5f72de1d3856566332e52f62a931a6fe6

  • \Windows\SysWOW64\kernel64.dll

    Filesize

    1.1MB

    MD5

    9b98d47916ead4f69ef51b56b0c2323c

    SHA1

    290a80b4ded0efc0fd00816f373fcea81a521330

    SHA256

    96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

    SHA512

    68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

  • memory/2104-13-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-19-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-29-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-27-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-25-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-23-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-31-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-33-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-32-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-21-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-17-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-15-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-3-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-7-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-9-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-2-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-11-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2104-5-0x0000000000220000-0x0000000000275000-memory.dmp

    Filesize

    340KB

  • memory/2796-72-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2796-100-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-98-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-96-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-94-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-92-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-88-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-86-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-84-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-82-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-80-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-79-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-102-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-90-0x00000000007C0000-0x0000000000815000-memory.dmp

    Filesize

    340KB

  • memory/2796-78-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2796-76-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2796-75-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2796-168-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/2796-71-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB

  • memory/2796-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2796-253-0x0000000000400000-0x000000000042D000-memory.dmp

    Filesize

    180KB