Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 06:28

General

  • Target

    cyberarticle-5.3-2009-6-11-crsky-setup.exe

  • Size

    11.7MB

  • MD5

    9e0e4751c795425d6eaa813f3991ec92

  • SHA1

    1b08e0137bdff848023b9f12567d20ea7f320774

  • SHA256

    0b9d803eba981c9202f4b60be9965f2b3cf4ffa9826763e90496fb89f71fa6c4

  • SHA512

    616557dd8a615c9ffc7c7aae21592a709c550e3958923b000d3ee8fb6b7b14534f49b1889d43e6463e0fb01d19220759f4d175fd637f1b02e48bda576da49471

  • SSDEEP

    196608:3cCx61EhWCYDJYJTctjWELBA98WEviRClyLjHXN8ZrDvj8tj0inYsocPgUg8G6YY:3k/CYDeJQjBnWEaRClyLj3N8hotj8so2

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cyberarticle-5.3-2009-6-11-crsky-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\cyberarticle-5.3-2009-6-11-crsky-setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Users\Admin\AppData\Local\Temp\is-TU2KI.tmp\cyberarticle-5.3-2009-6-11-crsky-setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TU2KI.tmp\cyberarticle-5.3-2009-6-11-crsky-setup.tmp" /SL5="$701AC,11958973,77824,C:\Users\Admin\AppData\Local\Temp\cyberarticle-5.3-2009-6-11-crsky-setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-6G5MN.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-TU2KI.tmp\cyberarticle-5.3-2009-6-11-crsky-setup.tmp

    Filesize

    693KB

    MD5

    c1cbb6595d397e53ca039dfedf39dfa7

    SHA1

    2aeb9cb218bb1481d749d47bde2c9244d15a68c1

    SHA256

    b50c3dbd3a9ee3fd61df5a882d35b340c6218528733e1727e736e91c9bb2334e

    SHA512

    2cf7082e93d2f453f4f2f549497857ffd493defacb6d677c1d68df774af623fe5855868a2a5e7439af62757e557f226fcaecbfa338ec8141298d69bdbefb03bb

  • memory/1812-0-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/1812-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/1812-17-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2728-9-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/2728-18-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB