Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 21:24

General

  • Target

    694aab9ca8b165b08b40cc45a9058c5a54088104feef55e3258e92b438bd0181.exe

  • Size

    893KB

  • MD5

    84552f0baff76fc1ab09a7ed62d75aa1

  • SHA1

    f83c077bf68580e41f457594cd029076b76da79b

  • SHA256

    694aab9ca8b165b08b40cc45a9058c5a54088104feef55e3258e92b438bd0181

  • SHA512

    bce65d53fdde5610f66833ae1a83267dc2c9e4449d0e35fe5d13dc170590112179103d829b46cb9d7a2c351822d36abc48cd2f5aa1a99ddf8caac8510cd84cce

  • SSDEEP

    12288:bOw2ad+evaRFzor4QYJuWbFPBbah11/ZyF7YLWYgeWYg955/155/7nwnS1dcs/:j2mvGhu4QiuWbFPUj1RG7YYnwnS1dc0

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Powershell Invoke Web Request.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\694aab9ca8b165b08b40cc45a9058c5a54088104feef55e3258e92b438bd0181.exe
    "C:\Users\Admin\AppData\Local\Temp\694aab9ca8b165b08b40cc45a9058c5a54088104feef55e3258e92b438bd0181.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\install7zip.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Invoke-WebRequest -Uri 'https://www.7-zip.org/a/7z2301-x64.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\7z2301-x64.exe'"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2680
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Mapping.bat" "
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Program Files\7-Zip\7z.exe
        "C:\Program Files\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\MapperBackgroundHost.zip" -o"C:\Users\Admin\AppData\Local\Temp" -p123
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:884
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\mapper.bat" "
      2⤵
        PID:1128

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\MapperBackgroundHost.zip

      Filesize

      8.1MB

      MD5

      071c4249e578294f2006c126b1b7d52c

      SHA1

      8b98e00f9df45631be24c7523ab3fc5329fc06c1

      SHA256

      8fedbe177e68447258df0db02e5f566307c1e21e3d6db3d5a7939274999abcc3

      SHA512

      144d9059e295d995c148a0c3aeb6383c4b13fee5ad621e53411896d107eefc4d38440d59a788802e5ef66b7366e43403df59669ac88f97a911def33073070d0d

    • C:\Users\Admin\AppData\Local\Mapping.bat

      Filesize

      483B

      MD5

      65ab752c33c277e2ece2b3387eb7b4ca

      SHA1

      6ad1eea8f64e072ddaa02f30eb1600795461457e

      SHA256

      30280cdbf48de9cde1895491a29f53d94bf28bdbbd2b9efc5eb9a178cf9de2ee

      SHA512

      729319fd971481883993f5f32facd8cb6494b97454f927b30bc2716f5fbe056d7542ce8756f11e017debad7966f32201e1093b3ac56183dbf7a11f64cc29c5f0

    • C:\Users\Admin\AppData\Local\Temp\CabB0EA.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\TarB11C.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\install7zip.bat

      Filesize

      741B

      MD5

      95e9966322c5d14439e0fb7ebb396833

      SHA1

      83ce9879bcc9c0fa86fa8daa86240d6499380784

      SHA256

      88a2aac0c2c285bb0fe110caafa553a438cecac00b504b195953b098dea14f47

      SHA512

      f2ebc31cf5bbe3f0e25bdd1aa84b294af2e97f9dec5eebee793e18d32b4c1079e4d3f29c452a1423b72397210ee324ca55dc2ccf524a5408ededc4303f47b764

    • C:\Users\Admin\AppData\Local\mapper.bat

      Filesize

      175B

      MD5

      2fe5a041baa9b097b49fe8fdad381254

      SHA1

      28099a854b4726ca228934606716f318533ed9f1

      SHA256

      39ac04c955f43c1cc3a07ecc66ef1ffb80edc4f09520ce7b68fb645fd14eabea

      SHA512

      f6ab109cc069b014cd336d6eec517176741c91d08f8b2b364ea111eacd167dfc2633d32993906cfd579c97ce6c432a24c9c2dca575d0290cdf1be92fbc027473

    • memory/2680-77-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

      Filesize

      9.6MB

    • memory/2680-74-0x00000000022C0000-0x00000000022C8000-memory.dmp

      Filesize

      32KB

    • memory/2680-73-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

      Filesize

      2.9MB

    • memory/2680-78-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

      Filesize

      9.6MB

    • memory/2680-79-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

      Filesize

      9.6MB

    • memory/2680-76-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

      Filesize

      9.6MB

    • memory/2680-75-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

      Filesize

      9.6MB

    • memory/2680-72-0x000007FEF5FAE000-0x000007FEF5FAF000-memory.dmp

      Filesize

      4KB