Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    10/08/2024, 22:12

General

  • Target

    Windows-outbyte-driver-updater.exe

  • Size

    21.4MB

  • MD5

    bfbb46c049e5d57500c3f5cdb1ba7f45

  • SHA1

    c58483fb9fe53e411c03be9d2d7b73bbe48793e4

  • SHA256

    351b5948fc7f05d1d6ecf2c46ccc82ad540859d9130be307e6bf22b41da1a766

  • SHA512

    b38198bb6a0b608c9d743bd481aa30fb7ab5df7f6d505002ae218cac716db4d673f3de37809f3fa2ee6d5c175ce72540edbbb6d2d6c25f81b1b69e280e3a2882

  • SSDEEP

    393216:xsT6+lrfqHjdxzVBVrij/jWMBncv83coV8GA8dvQa6dYN2yxOpgL+/zxazZ:xs++yxpajjaUZVb/d4a6dYN2yn+N2

Score
7/10

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 14 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows-outbyte-driver-updater.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows-outbyte-driver-updater.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\Installer.exe
      "C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\Installer.exe" /spid:1048 /splha:31860800
      2⤵
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      PID:2472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5be2574cd56e020193de1ed57382face

    SHA1

    da0946d0bb97eb1dc9940ea0f75fda035471173d

    SHA256

    a273286a2273c90c7aaaca6cae1777ec170e4374d61e084f67c55a7ef8fd39d9

    SHA512

    5c0894af071e11b63815811544d4d72b9511412a2ca6e4a903a1684321365792185d22986f016354c9ef0833c097d68079da47de9a2cad9ff99f8dec79ff8915

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2a5d1e690dac528fca1b3d8168354e4c

    SHA1

    f931208d58068f5e4754e734727fc2c9633b8cd0

    SHA256

    82abe99d76f3ec5d2860da041f78fff8216f443d459cf41b0e3a04cfa0722400

    SHA512

    4446c8b40466c5a471a2c6ebdc9415d3e9f644e0c329fd1fc9b996abf475094079db8ea6259c7e2d58b414f993e0882a0aa5d935544aa9e94d9cfefe1aee3051

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a7d6722c3244d1bb2e77cb1473eddbf8

    SHA1

    26d26634f3634e141a7fe5ab8b90f52dc49ef9cb

    SHA256

    7da9b4238b79c629d6b0e08dfe7c2d1fbbef1f6a64aea82211d84a126ac7d6f4

    SHA512

    81141210939400f217212674ed460958d811b28935abef510c1dd1b3de2165af009e54157772987ee72c21236b1f0383c4a6a18027ea856038e27a444bf2a920

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    17176e2aaa0d8456a7958ba458ecfd23

    SHA1

    b903e0bded508cc7b15f234955fc339f0dcedeec

    SHA256

    5215262df850745467f7e069988591854759416316df895ba1a11e974ede8134

    SHA512

    4fd5ea5b9b41db73a3003934bc0dd2a70fb7bf36db28f805cb107bfeb88e0ed46f47550b63c77c8f03ad6ca0ad0b1e1f691becab0544088a620c375b1895bf94

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d06b58b983a4ade8f67e780905eb3d41

    SHA1

    ce84160a948f05b8759af59feb7934ad91660877

    SHA256

    54abaa233ee4906f63dec058a3b9e3e8926beb5f090c5ef761804a8fcb13dad7

    SHA512

    1b9d9ae32a17178492f699a8345a4fa09b29a3e0245957606bba823febc9b1743db5bc553236ed62bc8e4ed7e4aae3ccfdc451e786eb3372b8da023d822f1b38

  • C:\Users\Admin\AppData\Local\Temp\CabD673.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarD770.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\AxComponentsRTL.bpl

    Filesize

    2.0MB

    MD5

    c3a7d193162a47ee3e83dc39aba8c5f1

    SHA1

    badd1de3c7c75ddd5d63bf7a77de468722c65f8f

    SHA256

    78849fb6dd5b547ee9b968cdd1a47dfd6808a34338667979b198742f3f2be761

    SHA512

    1317d7c4442d6b2ef4d1d0713c8f41b067e7cf8d28d08077b0760b36b7cf0aa8886620324a786386aab903ecaa034058cfc7a7bd7238dd9f30cf03df6e630bd8

  • C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\AxComponentsVCL.bpl

    Filesize

    8.8MB

    MD5

    20de92a935d8d45d012ab9198e9cc7d8

    SHA1

    65fe4e87a9f180db8638452bfe1a61f854bbfce3

    SHA256

    a0572c9047256bc8c509a9602907975e3bebebc35926d7ba8540e92cc1430d35

    SHA512

    cc6c7ec1304011813d41c1d23537d33e84741ff8fb1c115552be9d89d60c1530f5c7787fbeddb31ad5a88a8f81dd7374b2808fae98d0c97dce07a245e17e7603

  • C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\CommonForms.Site.dll

    Filesize

    340KB

    MD5

    2ca11db4d0c2a737187c002f731e014a

    SHA1

    dc4adc97c6364b8048da0e10e5c533c7b54b1ed1

    SHA256

    7230f57df4b2b8b91e10dc66efcfc3096306d29a5513b0eab96024f4ee465cd4

    SHA512

    1de2277df5c0e86faad95c8e6dd31bfb62efbd7410ef6629b5d850e41a3a124c279c2633b16c30126197f0036240eab66cf9cf36e120c3b0984a2fd7e17d5381

  • C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\Data\main.ini

    Filesize

    1KB

    MD5

    1222fe3b63384757b322d6504c37d444

    SHA1

    e2ea1911982e8de26757b863f4a65463ea0fde42

    SHA256

    7853bde1900a821b07e2060fe04902c38de9597dd763c0cea75fec7f83cd11e6

    SHA512

    8f86e6d1835d012541bbc28042cb6774de705698a2ce4340b20f92b7c3077027a9b8a45c4030ef84e951204fd941cbb7e0cc94f8dc7de0c770bdeaa8b4b1d4df

  • C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\DriverUpdater.exe

    Filesize

    7.8MB

    MD5

    8a520f86384958fb76e084f556056b50

    SHA1

    b2935226f66af0ea849e449869496f89fd2efe37

    SHA256

    1f31162d1f0e346b1da0af8d11826893dfdca8465e6c98236dd03946884d3487

    SHA512

    9f373ce32a58b5ae9abfb7b1e8ac447e3b8be1c403748e6992af7b00eb7a200220462413c3cbfefd4a8bfbd54f4f60f96f7a04e4ed9e87d36460e80e18b340b8

  • C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\Lang\enu.lng

    Filesize

    266KB

    MD5

    9455ecd37be8ee2d3949a4a34ede2dd0

    SHA1

    6f5c773f713929f7a54dffc000954e32b98c7761

    SHA256

    074673c79fc8606b5a87cb5a52f4a91218831dc53b8e63a3d8e4edb41357d2de

    SHA512

    2e1cb3017502983c02b823608d2984f1a8bcac86b0181da7a2240c0c80746f8839d8fef43b33d7db522b3a07f1caddf69c1b5f62193e14ec59da349b242a9cfd

  • C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\Localizer.dll

    Filesize

    192KB

    MD5

    858416cce9c98c40050de9aa06af2022

    SHA1

    4948d0ccc91eaad1abf5bbf5be7023b4fed6f97b

    SHA256

    e88c68ece877c2c0b2d8c41efd40d3c8ab1f2957ea8e11493a373744c13e0573

    SHA512

    d576f53227ca18ba8bdfb567052eadeb9ce353351b80ccdab35838c804bc61f429e439aad5f559e60699996ddaa72c3d01990558f57b52d0dc34d9ed5cc29c6f

  • C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\rtl250.bpl

    Filesize

    10.1MB

    MD5

    481b636bd54e231810c7d2c045d70168

    SHA1

    ce6fefc5525ad08eba947f1781a248141a846f77

    SHA256

    4722ef802ce0f9971ee37d56cb821800c11048c4bf72d81b6702ca7690ab531b

    SHA512

    c1d4490e63394f438adbd055868a254f2cd0ab5bdd8f32f92d2d1050c01b91a0764b9391335fe9d4a73fb766cc0a12edfc2b96597d4fdade5898ddfcb841f2a2

  • C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\vcl250.bpl

    Filesize

    3.9MB

    MD5

    841026051b1d109df5808266ca610c6e

    SHA1

    a1523033bb2ba78d1ad58736d1300b074f62cc25

    SHA256

    2dbaa8b91e2e9fbb1e9a9afafa192386c30c2cbc87da9af77a763e11122a1e17

    SHA512

    eae1594a758f0f4defce13582a455041ddb0abe8442fa7ddc2afe139a2aae939a4767b1ca936c7b6eaf6777847d453ca3c1af254fd59611b3bbc8d9a30077d9b

  • C:\Users\Admin\AppData\Local\Temp\is-28752131.tmp\vclimg250.bpl

    Filesize

    365KB

    MD5

    eb89b73cd72b9077ca542b0d2582f20e

    SHA1

    7244f3facd7c2f061a9adb2085d4f7f05551732a

    SHA256

    1c2c45a932484bc94850911e27942e461709dc5ff7747020267d984e4e404aa2

    SHA512

    2e2d184cea520675072610a6fdc26d0b6d683d286b9ff7766b179a473fa15b4c8cffa3865fe8ef434e88695ac122aaaff84516f2aea3d07ad7a78bd9d0f2643f

  • \Users\Admin\AppData\Local\Temp\is-28752131.tmp\GoogleAnalyticsHelperIV.dll

    Filesize

    266KB

    MD5

    73b390d24b06f5b17dd4c183e5fc2aa0

    SHA1

    478982b5cb05dda43226b61f8b96a0feb6b8b394

    SHA256

    76d7ef3511f3cc5aec32cdcf29b59a7138e193c850b774bfcace8128b75194de

    SHA512

    97d666c29be04e8a9adf64c9d5586822f3601291ce8ab53e792b0e8c8929d24636957e71a3ba42809a023935818ba3ba8811b66d4ca516ec132a588d39f8ac08

  • \Users\Admin\AppData\Local\Temp\is-28752131.tmp\Installer.exe

    Filesize

    2.7MB

    MD5

    2f1908b8473bf08aff928a95ee9adf2d

    SHA1

    fad3a05535afc1903aafe25043e01151e1ca1203

    SHA256

    a9c97f9bdde97f6a761cae877e4d90b9e07253c5fe6e683708423e1cb90a535c

    SHA512

    ac7e8f14340ed8a1cc4993a72964424b566e13062dc83bebaed8c4836db4c7e116e78270f65b62716d51be7d8182512310c1406b6d572edebcfbfc8c5051e29f

  • \Users\Admin\AppData\Local\Temp\is-28752131.tmp\InstallerUtils.dll

    Filesize

    933KB

    MD5

    95d95fe50bee00f87946a2cd1d43fb66

    SHA1

    e56d2fc1566a59f5a557dd89aae2041a23047c09

    SHA256

    adc52e27a490b387c9dfbf9562d309c7a588c5732cfe3a90b45268a5eca94c5e

    SHA512

    fca84ac09d5db8d5b3633257e529f292f61c0e8b549ae9c5766192c157b57c829f55158311434e4ba8fc81929d5c82bb9bbe1de74e44c0015b01fa3cb35001d1

  • \Users\Admin\AppData\Local\Temp\is-28752131.tmp\OxComponentsRTL.bpl

    Filesize

    1.2MB

    MD5

    eaa639d3b6fe692beb942c27d7d2724b

    SHA1

    b51aeb650f5db4c82229ad23921dcbe41a5c1340

    SHA256

    654d5c7c5d256ce188b821f598be9cbcdfe61d6414b6d1fbcb62d1483d8c8ab9

    SHA512

    6df81bdd6ef6122e492f098efde8af2e0e1bd39ffb43e602d6300e20da21a9b22f6b7f5b4c146d582177a7677f67b4d2eec714685fafde24c46214e963e1c59e

  • \Users\Admin\AppData\Local\Temp\is-28752131.tmp\SetupHelper.dll

    Filesize

    3.2MB

    MD5

    7a29a34755754b7541afcd5bf1801341

    SHA1

    24c6a94bcc4efba674f3252d0a38a556374e9a9d

    SHA256

    139470e7e2ffe39daf8bb722cfee05bea1e7cecf6fd6ccff31431a897de9d1c1

    SHA512

    1fe7bf3739630d7293b67b89b97a60ad048bcc5f3686b892debce4b6e368888c04de5282d33e87db36310afbef6bbcfd1d743b39858a6e432fe92fd1771811c8

  • memory/1048-609-0x0000000000400000-0x0000000000481000-memory.dmp

    Filesize

    516KB

  • memory/1048-3-0x0000000001EC0000-0x0000000002203000-memory.dmp

    Filesize

    3.3MB

  • memory/1048-7-0x0000000002BD0000-0x0000000002CC0000-memory.dmp

    Filesize

    960KB

  • memory/2472-607-0x0000000008600000-0x0000000008943000-memory.dmp

    Filesize

    3.3MB

  • memory/2472-793-0x0000000000240000-0x000000000029A000-memory.dmp

    Filesize

    360KB

  • memory/2472-42-0x0000000000970000-0x0000000000B6F000-memory.dmp

    Filesize

    2.0MB

  • memory/2472-45-0x0000000000B70000-0x0000000001596000-memory.dmp

    Filesize

    10.1MB

  • memory/2472-600-0x0000000007000000-0x0000000007045000-memory.dmp

    Filesize

    276KB

  • memory/2472-589-0x0000000003570000-0x0000000003590000-memory.dmp

    Filesize

    128KB

  • memory/2472-49-0x0000000000240000-0x000000000029A000-memory.dmp

    Filesize

    360KB

  • memory/2472-603-0x00000000070D0000-0x0000000007102000-memory.dmp

    Filesize

    200KB

  • memory/2472-791-0x0000000000970000-0x0000000000B6F000-memory.dmp

    Filesize

    2.0MB

  • memory/2472-789-0x0000000000400000-0x00000000006C3000-memory.dmp

    Filesize

    2.8MB

  • memory/2472-790-0x0000000050000000-0x00000000508D7000-memory.dmp

    Filesize

    8.8MB

  • memory/2472-797-0x0000000008600000-0x0000000008943000-memory.dmp

    Filesize

    3.3MB

  • memory/2472-796-0x00000000070D0000-0x0000000007102000-memory.dmp

    Filesize

    200KB

  • memory/2472-795-0x0000000007000000-0x0000000007045000-memory.dmp

    Filesize

    276KB

  • memory/2472-792-0x0000000000B70000-0x0000000001596000-memory.dmp

    Filesize

    10.1MB

  • memory/2472-794-0x0000000050A80000-0x0000000050E72000-memory.dmp

    Filesize

    3.9MB