Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

c24e9ac38d...ab.exe

windows7-x64

7

c24e9ac38d...ab.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    11/08/2024, 02:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c24e9ac38d21a8cbe06ca9e00f44e14d5ad3febfcc9c161c9be0cfd9d012abab.exe

  • Size

    2.6MB

  • MD5

    d26c56424c414e46e28793f8129741ba

  • SHA1

    73ad5afc3f8b63b5d745175842f5e1c7fb214c33

  • SHA256

    c24e9ac38d21a8cbe06ca9e00f44e14d5ad3febfcc9c161c9be0cfd9d012abab

  • SHA512

    07bb14a84fcbf96b3ce0bcd9aea5659893427d79f586ba3bea832b5cc752ece29eb57cb5502b6740da9b351ccc89649381d0a7788532e5c58167b2279add68f3

  • SSDEEP

    49152:LtckVb9kXDA0vhCcD0Tgy0LXu1qoTzmYvr6/TH:ekVODA0vkcD+v49pN/T

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c24e9ac38d21a8cbe06ca9e00f44e14d5ad3febfcc9c161c9be0cfd9d012abab.exe
    "C:\Users\Admin\AppData\Local\Temp\c24e9ac38d21a8cbe06ca9e00f44e14d5ad3febfcc9c161c9be0cfd9d012abab.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Users\Admin\AppData\Local\Temp\CA70.tmp
      "C:\Users\Admin\AppData\Local\Temp\CA70.tmp" --pingC:\Users\Admin\AppData\Local\Temp\c24e9ac38d21a8cbe06ca9e00f44e14d5ad3febfcc9c161c9be0cfd9d012abab.exe 6C79D8AEB402318FC6AD9E5357D779D20A21B0CFF0BA367BA9309320FE96E64F393A8FF8B0728648BEE64ADB89EFA53431EC0D0C79799D65E7A6E95E7A895E1A
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Users\Admin\AppData\Local\Temp\c24e9ac38d21a8cbe06ca9e00f44e14d5ad3febfcc9c161c9be0cfd9d012abab.exe
        "C:\Users\Admin\AppData\Local\Temp\c24e9ac38d21a8cbe06ca9e00f44e14d5ad3febfcc9c161c9be0cfd9d012abab.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious behavior: RenamesItself
        • Suspicious use of SetWindowsHookEx
        PID:2220

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabE17B.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarE19D.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\c24e9ac38d21a8cbe06ca9e00f44e14d5ad3febfcc9c161c9be0cfd9d012abab.exe
    Filesize

    1.0MB

    MD5

    03b18ee5ae548b01cf455ca56aa2daae

    SHA1

    3149878b9d40624265bd1abd63632ec21bf36c8d

    SHA256

    9f581b5730b3f10de2a3b3a21d3e476f3094feef3e4dd92ffdaa103f6c410802

    SHA512

    919b9e512a30c643052337e461fa1fbd055932b4a557753fe03ebab29925bfc6d1aba61a92f320729569a5ad3d60e7493b43e366313f5328caf0597772f60721

    Download Submit

  • \Users\Admin\AppData\Local\Adobe\downloader.dll
    Filesize

    737KB

    MD5

    7c130d8567d6e4c1555174af578918a8

    SHA1

    bb1f72b7eb5aa6ac54733f01d4195841dfe72cc8

    SHA256

    1540c84cde9716b2abd70e0efbf6beaf9eaa169b4dcaf157bd124f098e4abf38

    SHA512

    bde576ce37023cf1b4494106d65ab6e552d9d94622c88e074e9572d89f2d97371fd53697562f6c26147176825b84b6f7ea893c2cfd0fd151a78e6137165ff8e0

    Download Submit

  • \Users\Admin\AppData\Local\Temp\CA70.tmp
    Filesize

    2.6MB

    MD5

    833c113a71aadfda7f1b3f1eef38bd98

    SHA1

    0c7e156a153fda40ff69182832e14da037cca0d7

    SHA256

    2dbff3985aa71121afc8dc7fd22c862ce44468373de9fe9efe8fdf04f616de63

    SHA512

    c7b798365d999d3325e170f0c586b4e9742e3ff3fffa1124af4d1dd4c71a4793dd3596ab29e478dd9114fab43ded8b118fdee5c7b550b84f8cccf47ab5261f56

    Download Submit

  • memory/2220-13-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

    Download

  • memory/2220-74-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

    Download

  • memory/2900-11-0x0000000002860000-0x0000000002914000-memory.dmp

    Filesize

    720KB

    Download