Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

f6e5f41799...0N.exe

windows7-x64

8

f6e5f41799...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 14:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f6e5f41799603f7cb238821b079e3e10N.exe

  • Size

    2.3MB

  • MD5

    f6e5f41799603f7cb238821b079e3e10

  • SHA1

    efb656af7767415dac199ad1b014b0fa3af573b0

  • SHA256

    ec6d0e3f9da911c77c2ad759220a26515e1a9111998fda19d3296bebe0796fdc

  • SHA512

    38e119988dbcb608c8a62e7a5062479bd6043cf8f2e705160be66cba524dc8154f04838aea3e8dfad45579106ab12379b1c4de6aeedbeb38ac864f7e83e251b6

  • SSDEEP

    49152:0jvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:0rkI9rSjA5aDo73pzF2bz3p9y4HgIoov

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6e5f41799603f7cb238821b079e3e10N.exe
    "C:\Users\Admin\AppData\Local\Temp\f6e5f41799603f7cb238821b079e3e10N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    84122fb3e4041825d702d354566bb3f0

    SHA1

    94814cf5313a084972a81b74ef1495c76a76fe30

    SHA256

    09e2647a947bc014ff78872e6b885abb18f2e8d6137557b851428879a8523f87

    SHA512

    0925bf574dc603bf86aa665d87eba5f8b1e87ed3e27a5260fb9d76ad920af6f5b75f004acef7ee76b1c775f45c84162235dd7f19656334643a3bc2737af77931

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    30af2745123568de92a5898e7f282760

    SHA1

    7a49dfe2b4b2bf84cefc84f55491b06b6e36cc98

    SHA256

    39147bc5eba3618ce94640b781d5246f04694472a817de77728a6a30dbdbdb64

    SHA512

    3a5bb1df8860c1c8b7ea7d30b8f01629ae7a540197ec41afdcc61df6c5ec56918c0bf279b16cf729d87e0a3f02a60fa6000a1ff6e90fb6e1c5443a5c97cb4379

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    55b37e8684a19c3ae1708f40a5910507

    SHA1

    e0f291d740e5dfcd81233134977e450b0bb1d688

    SHA256

    f38c1e5b6a8ad73f50aa878a0d2729422d265f5d1c302a8cf8e01ea5b5f18ded

    SHA512

    cf0d10951acf328b28271339cc12c276b7f69afa4dc90f4203612be9d6f7ce4f2cbaf495ba86d9b6f75444a94f734d150daff0f49e795fb8d856e3aad2990fc9

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    2.3MB

    MD5

    e986351a9d9b9122eb41f4ac56b9facb

    SHA1

    9212e5246ceee50e9b781bb2a14577716a42ef32

    SHA256

    e3453e9e6aa6be79aa16bc026132e084c94fda6ba3d2ec0ceed48c46a7451b3c

    SHA512

    e1da8cbdf7a1f85ea909dd09f6cbc379e9b16daa98f00c172f122854a6333a75b345b3e1a5388dbe5d39f4b25fe2dc4cdec3f95482f26f4e8b07e6185817a471

    Download Submit

  • memory/2768-51-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-55-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-67-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-65-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-63-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-61-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-59-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-57-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-35-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-37-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2768-43-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2768-53-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-45-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-46-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2768-48-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2768-47-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2768-49-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2880-29-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2984-0-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2984-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2984-20-0x0000000000170000-0x0000000000179000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2984-36-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2984-25-0x0000000000400000-0x0000000000DCE000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2984-13-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2984-28-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2984-26-0x0000000000170000-0x0000000000179000-memory.dmp

    Filesize

    36KB

    Download