Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    29/08/2024, 00:08

General

  • Target

    c7b2759c599ed4c14b5e3f3bc02b93d0N.exe

  • Size

    116KB

  • MD5

    c7b2759c599ed4c14b5e3f3bc02b93d0

  • SHA1

    bdf53006a54b8f44f50143fe2129ccabfaca4292

  • SHA256

    d46896a61b939a1dc97f6ec994463f6792ac35dc96c127a11fc8c1550a9b0bbd

  • SHA512

    ce0b9fe4bd0985240b0a004d2ca561ce6522d279a29f03bb96d834a8df5b840004f5f1844264d557dcdc8d0b740b85699157c998cbd6a9168c20470f6c150d60

  • SSDEEP

    768:t6eHIMgPRVUUC151Npquv3RnFKE7pGnbcuyD7UTTE:tFo5U5bLpXRkPnouy8k

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7b2759c599ed4c14b5e3f3bc02b93d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\c7b2759c599ed4c14b5e3f3bc02b93d0N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\GUQOT.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2616
    • C:\Users\Admin\AppData\Roaming\trys.exe
      "C:\Users\Admin\AppData\Roaming\trys.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GUQOT.bat

    Filesize

    135B

    MD5

    6dbb2090ff90500da05a027765cde190

    SHA1

    425b833d9d1df8d6df6e5a59f738058808271949

    SHA256

    71ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881

    SHA512

    7e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3

  • C:\Users\Admin\AppData\Roaming\trys.exe

    Filesize

    116KB

    MD5

    f536900fd17752132f5e0b3a8afb4b66

    SHA1

    b40a2baf7ecc32e153fa4fd1e6e807964ee4f855

    SHA256

    4712cdb0b39b0daeb8093e45e900dcad8ea025fcfc4d075a9260dc087831babb

    SHA512

    33819e29ddae4ba74a9357193f8d1af703fa25698a75d8987cb86b5ad44647e750a4ea88a22b6b58b9388160ad02d9a01756db2d4d1d09d262d666f8deb5d259

  • memory/2780-50-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2844-0-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2844-33-0x00000000003E0000-0x00000000003FD000-memory.dmp

    Filesize

    116KB

  • memory/2844-31-0x00000000003E0000-0x00000000003FD000-memory.dmp

    Filesize

    116KB

  • memory/2844-40-0x00000000005E0000-0x00000000005FD000-memory.dmp

    Filesize

    116KB

  • memory/2844-42-0x00000000005E0000-0x00000000005FD000-memory.dmp

    Filesize

    116KB

  • memory/2844-46-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2844-47-0x00000000003E0000-0x00000000003FD000-memory.dmp

    Filesize

    116KB

  • memory/2844-48-0x00000000003E0000-0x00000000003FD000-memory.dmp

    Filesize

    116KB

  • memory/2844-49-0x00000000005E0000-0x00000000005FD000-memory.dmp

    Filesize

    116KB