Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

318ca44c88...bb.exe

windows7-x64

8

318ca44c88...bb.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 20:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    318ca44c88998a2f54ea5e5ff85010481e0bbedfe2f71320483ed34fe7a564bb.exe

  • Size

    2.3MB

  • MD5

    6795e1d303b6ffa9b9fdaeaeac35bee7

  • SHA1

    373734016d1261151b632f5ca17914eca92e2821

  • SHA256

    318ca44c88998a2f54ea5e5ff85010481e0bbedfe2f71320483ed34fe7a564bb

  • SHA512

    69bcfed71817c187aad2a2a9edc6f0912b1191182d8fdee048435c17f87d8d117904f6cb66bd5f810e2581fe93c0c21dfd250e107f8c9eafdd1c4d90c2511b4f

  • SSDEEP

    49152:Bjvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:BrkI9rSjA5aDo73pzF2bz3p9y4HgIoov

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\318ca44c88998a2f54ea5e5ff85010481e0bbedfe2f71320483ed34fe7a564bb.exe
    "C:\Users\Admin\AppData\Local\Temp\318ca44c88998a2f54ea5e5ff85010481e0bbedfe2f71320483ed34fe7a564bb.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    da4ba1ca975398bc3f3a1ff839882f9b

    SHA1

    4560cdca8b0d68d61fd78d39d1d0741c728bea59

    SHA256

    34a789705ec4cdc0e666ab1c11770aff9cd2c1fcd09aa9b3b438efb5f755e049

    SHA512

    8373eae410a7b2ca5792202a859ad753e9a3b36ef1e90ce186a2e9ed753a83e7795fc533aa4252a5309e6ce081423d71c356fe57cb32f706f5557f77eb075a24

    Download Submit

  • C:\Windows\SysWOW64\smnss.exe
    Filesize

    2.3MB

    MD5

    d8422ecbc164b7f8df69cf5c76e77d2a

    SHA1

    fd89eb2eaacfb3b3c05340da55a0906a714872af

    SHA256

    b75d54fc72c930ebe31e3faa96ef25ac38a84f6e78389956fb40a3b1a7c62830

    SHA512

    73ab4560d8cc403cab809d25bac74d778a60204d4befe7875967aa28f6ad46af07371fbe9acb01adc5d34fdda6ddf7d76a794306725ad2d2e563b4a483d1855f

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    407109573402eafefc84eea8b463b070

    SHA1

    e3a7d4b2cea14c78498b336adf0584e7c29243c6

    SHA256

    0db51a79f057acc0c2b43a73932455e07d5089c68ee7ae47ea333bc96be5e100

    SHA512

    3631f72ceb142186019b0b8095276971d1246e03c7c1a10c068d218746d67654abc6f48874f38d164a2c1ecdc3bbf43bf270d0b09c0908cd9cbcf3a1317031bc

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    7b8473fcf68d33bd04e0a27e1e3f9666

    SHA1

    630803b5a585992ef69a484c55e735749814f2ed

    SHA256

    6e983400ecfc22476d68a6c8c8401c317fad17d98d3ba143e9dd3e927d5167c5

    SHA512

    3a30853b289d609ad6a6ed4628f2743d0a18c83f2e68c7099427c611d4901ec6ab63180838cbad8f7869eee90b2f325f199bfdb9aa0f32f39c62884a4a9104ed

    Download Submit

  • memory/1820-31-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2884-55-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-49-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-73-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-71-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-35-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-36-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2884-69-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-43-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2884-67-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-45-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-46-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2884-48-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2884-47-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-65-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-51-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-53-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-63-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-57-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-59-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2884-61-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2972-2-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2972-33-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2972-0-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2972-42-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2972-13-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2972-32-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download