Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 01:49 UTC

General

  • Target

    5cca916c65c66e18fee71185f716090f8b69894f7a2a9a2a3568f599e6a9882a.exe

  • Size

    3.5MB

  • MD5

    2868f61931a02dbbc3590b81aa0e607e

  • SHA1

    aab4aace0e4af4e8b4c78e24c5e731241b8d9751

  • SHA256

    5cca916c65c66e18fee71185f716090f8b69894f7a2a9a2a3568f599e6a9882a

  • SHA512

    c183b70a445ef2a1e572b2cb761c97e10c4fc9de0581327ec859d1a17cd9879327febadae8d5536b6d9b649cbb6c86b3e73def60d021b2d6a94cda56ab5fbc1a

  • SSDEEP

    98304:oJcUQLUGrupm8ECjd5bzSq6uxlZKL+DIvb+RB07K:GPGZKm8Ee7z7RMiXnF

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5cca916c65c66e18fee71185f716090f8b69894f7a2a9a2a3568f599e6a9882a.exe
    "C:\Users\Admin\AppData\Local\Temp\5cca916c65c66e18fee71185f716090f8b69894f7a2a9a2a3568f599e6a9882a.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1152
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1928226 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\5cca916c65c66e18fee71185f716090f8b69894f7a2a9a2a3568f599e6a9882a.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2958949473-3205530200-1453100116-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Public\tmp\document.docx"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3040
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          4⤵
            PID:532
        • C:\Users\Public\load.exe
          "C:\Users\Public\load.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2140

    Network

    • flag-us
      DNS
      www.tencentcloud.site
      load.exe
      Remote address:
      8.8.8.8:53
      Request
      www.tencentcloud.site
      IN A
      Response
    No results found
    • 8.8.8.8:53
      www.tencentcloud.site
      dns
      load.exe
      67 B
      132 B
      1
      1

      DNS Request

      www.tencentcloud.site

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      19KB

      MD5

      a1559d08c9fdfe688478a5cc08ed7691

      SHA1

      eca898ec540c5eae5f6d042bee551c5a73312b7d

      SHA256

      af4dfeb39acf6fe9a230b5947926715d25f283ef154a3b077753bd16acbaf879

      SHA512

      d7abc58a3080d92be27f23895fe11fc07a86f6db8b3098a1ac22e971619c607507eff04c4806bf3328f9801f0ab9dbf470f9bb95f99cc82496013d740ee929db

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • C:\Users\Public\Uninstall\uninstall.xml

      Filesize

      7KB

      MD5

      f92db87c6a6aec3e316a8a2d01fb42e5

      SHA1

      5495e8380032937b15b5d6b2396106ef95c0c245

      SHA256

      82ababa5b07f0e7f8c0d16a92a45e6aafa42ff8f3ff53b6aad855190c61ad912

      SHA512

      db0f79884cb8331ffd3fd441ada08520b973590d7e0305390e602a5ee1299e807a2b45189f7df9e13292c324a6af95ca9bd61cef715e00852bec1d19a1f8a936

    • C:\Users\Public\tmp\document.docx

      Filesize

      1.3MB

      MD5

      3c864941dbc7c30b91700d20e038db33

      SHA1

      6d717e5030917bd33ce817b30d61c705a23e72ed

      SHA256

      8442767b5ed63b7d76b7f8d6738402ef0561fefc811684495ae89ecd05f11ff6

      SHA512

      10e151c448f28fd5e9a883194a716f81769145de3657c6e152f6b821d252142d8ca713b5d68e915f660a975344331fbf0f50668836999cd97f2cb43dbc34f9a4

    • C:\Users\Public\tmp\~$cument.docx

      Filesize

      162B

      MD5

      e3607c300f8b4d23e10205903b7ad8d5

      SHA1

      285404c8b6ee1c8fbc4b4ec05f6e842cddb04773

      SHA256

      8986f5f98a2617dbf5ef61354260003f097253e8b13a72b7ff9cc3d673b94bf6

      SHA512

      de0aed25da2a1452dd0f3c85a2a9784597f14f69b2a93a2775f9d18d2f6908d5cac8825e2384a9456a20f4d0f9eee4671b57c32b2ef17436d584a7f29a5b0d86

    • C:\Users\Public\zh-cn

      Filesize

      289KB

      MD5

      819f068ac3ba2f08b55c2a0f6b771583

      SHA1

      3685b6d73f076ea5c8a94c833c0c9ca619807ab2

      SHA256

      6f817f367849b33de103f1d1a135ed7832874ba2ad42a3fb25f20c71f2db04bf

      SHA512

      209f77f0a790dff544eb5d1c57b9200ed0676a5be2c98529d85e3f0ce0b613aa395f1274ce70c33998ec0603b3dd4479bc91005c74fbdd35467544902e931c15

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe

      Filesize

      1.3MB

      MD5

      7eb6266334c70e3ffa235d2571614734

      SHA1

      de003214a0034ca3dbe9ed35f482f2aaa235c5d7

      SHA256

      0249a947699c4b9678718905d93811a0abb4e1b9528c405f70102ceea68bb00f

      SHA512

      f965de30102d1ca4f305379ce719378dc9bf23fb461318558548df9304154636123b4dea8ce19bc339d53f4c0bfc85205807250fe253d763da08105336ecac0d

    • \Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll

      Filesize

      326KB

      MD5

      e7a789232ef503dcb4929791673009a3

      SHA1

      8bc28bce4c9d8b4a6e360100441ba54a878de4c1

      SHA256

      89daa79b558055f6f893abf38a0f17d3e1e0193d59dafbdf98d72d4e5961c2a1

      SHA512

      6439a2ec5e9d486c15a37a736bc8d36d8e5f6ecb6a354d0fdd7efc9dccd3fb6bdb208a051b0d81f101669169826e07f9b4ddd79259c79c1e03856af5a9442b87

    • \Users\Public\lang.dll

      Filesize

      183KB

      MD5

      13274229a2af30f6e20ee9c0f20108d2

      SHA1

      a27e58fdcf833206946ce8d92a852782a280d0eb

      SHA256

      215c9890c3259f3ca89368c12df1691a82516cfd42df1128983ce36047c81273

      SHA512

      862e9125b19850a6a07e312854ec34492b584b6f7831463aa94e40ba92b3518db2a1b587d7716b2a70860faa891a17110d9805c167ef64a40731b857c6f0f7c6

    • \Users\Public\load.exe

      Filesize

      28KB

      MD5

      16c577b885a3293edb8ac665b2070b42

      SHA1

      4876900fdb45b6ff78851eb9ed319760f72904f1

      SHA256

      16dc6ec0d946d0aabfdcf8975dffc5a914ef09c9a6ddc86bd5f8c7030c56e1e2

      SHA512

      b69dfc1b91063d171f5756d9def0b5616f9871b711305c436e2c6e0a163a98a8ed1dad60dc7dcc2a7ffbe81ae037089f9f7fde448eb5515b34846b04b87050a3

    • memory/1152-73-0x0000000003220000-0x0000000003608000-memory.dmp

      Filesize

      3.9MB

    • memory/1152-46-0x0000000003220000-0x0000000003608000-memory.dmp

      Filesize

      3.9MB

    • memory/1152-47-0x0000000003220000-0x0000000003608000-memory.dmp

      Filesize

      3.9MB

    • memory/2140-94-0x000007FEBD640000-0x000007FEBD650000-memory.dmp

      Filesize

      64KB

    • memory/2140-97-0x0000000000470000-0x00000000008DB000-memory.dmp

      Filesize

      4.4MB

    • memory/2752-90-0x0000000000D50000-0x0000000001138000-memory.dmp

      Filesize

      3.9MB

    • memory/2752-75-0x0000000000D40000-0x0000000000D50000-memory.dmp

      Filesize

      64KB

    • memory/2752-52-0x0000000000D50000-0x0000000001138000-memory.dmp

      Filesize

      3.9MB

    • memory/3040-91-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/3040-141-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.