Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

f14a1f82a2...0N.exe

windows7-x64

8

f14a1f82a2...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 19:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f14a1f82a275374a6dd60768a06c0420N.exe

  • Size

    75KB

  • MD5

    f14a1f82a275374a6dd60768a06c0420

  • SHA1

    c1a259bbbc50fa57096ccbaebea2d358d1ac0dfe

  • SHA256

    a4994460a81c23b2b29b6515d014b0ed11b8e23588d14d8551650d609bcd96d0

  • SHA512

    a5607ce5cf262f02bf66dbd5eebeedc004191e721ad3698f4ec5acaf63a8848f77fd5f4720cdc9d14c2c0639435ef198906ec519241881a03cbddf23cfada240

  • SSDEEP

    1536:Xx1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3v:BOjWuyt0ZsqsXOKofHfHTXQLzgvnzHP3

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f14a1f82a275374a6dd60768a06c0420N.exe
    "C:\Users\Admin\AppData\Local\Temp\f14a1f82a275374a6dd60768a06c0420N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    b62076ae21efbcaf1c7bddeea1de0093

    SHA1

    421d7d06ba33f1ca22253a221391a3c8bb3c9317

    SHA256

    aa3d45274e5b62cbca98f51e1e37cbb31c3b3c100b3e27c958ca637e9e43b706

    SHA512

    b3a9321ffdd60ee075d8e19c146c73b944a9c1fe4b6b00a2b27f8197bd004e5eeee851ecef399535b105015692757178b9d263800d162fff6309bdd5297f5dee

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    4069b4d7bf328fd7bbce435bdd3c93a9

    SHA1

    967872414c9f59ddb7648c73970d70ccf29f6c97

    SHA256

    a247e371116395c3ccbadfd180863b1661d07fb6de48ec5a0e847db50ac07fb5

    SHA512

    2bfa0d70c425cfa3be899cf95bdd9f86be6a61a96d8983df14fe38b394b9760ec51fcf7e99db5d4e4abf059dff449300d8e56b49ec2b75c593359d4a11a2d50a

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    762ee4230c2ad5f9eaf01f2fff5c8687

    SHA1

    834c8e9a1c0870eb69d27fc72a07fa92706e03d0

    SHA256

    9167d212d7db79761b24d502648d4bcc3c1ac0ed7bba56a4858bc62e45d722bb

    SHA512

    6c3ec3068dfa928e5ed310a67bafe102d08c71e6455bca759e566bd553f7e8cc49698d98117c889a30ca2c90a0e2a6b49aaf3bd3dbe8c8592056906b9474fd53

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    75KB

    MD5

    93d17b04b8d15ae275c612b8ee70108e

    SHA1

    df51d946af7cad776312f62066484428a28c7f82

    SHA256

    f22ccb4a728cf7f2afb6b78c2455e8824ae871c5c5cb4554d238b5b661b2c2d4

    SHA512

    3e3be5fa24917993969348452ad068184c964120d863d67aa85726d2e180976ff2c114e193dd0a0d9e8d634b2a95206088400deb2934016222a594c055e263c5

    Download Submit

  • memory/1952-15-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1952-25-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/1952-22-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2188-26-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2188-31-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2320-40-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2320-39-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2320-42-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2320-44-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2320-46-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2320-48-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2320-50-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2320-52-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2320-54-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2320-56-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2320-58-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2320-60-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

    Download