Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    72s
  • max time network
    73s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 13:44

General

  • Target

    c72839924b296de9d93bf0d0f0b0ae90N.exe

  • Size

    68KB

  • MD5

    c72839924b296de9d93bf0d0f0b0ae90

  • SHA1

    4d89a886b6edd2d6d8cf0f3c9252d40fda5d4f11

  • SHA256

    79a0c053eb1b1ebbf36faf5a6464a3e20ad9dd36c317212a9ff7c4ae8de08224

  • SHA512

    ffab585da975174372dd537a03436b4a01abef81b1a16a5dbfc04383694859c05a75658e6cd61c734b1ad4751a744f645af5d21a76989dcdc9fc60886d23e003

  • SSDEEP

    1536:Htq94hUwA6CTC7ckEtCJTmHH5jXHdQ/JoUJsV44cpU:xS6CGAkESQ5jHdQBJs

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Deletes itself 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c72839924b296de9d93bf0d0f0b0ae90N.exe
    "C:\Users\Admin\AppData\Local\Temp\c72839924b296de9d93bf0d0f0b0ae90N.exe"
    1⤵
    • Adds policy Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:292
    • C:\program files\internet explorer\iexplore.exe
      "C:\program files\internet explorer\iexplore.exe"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1748
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\dfDelmlljy.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    402e2b67ffd36778247d2dc53613b90e

    SHA1

    88a3512aca9f654f11603be708d19a4a98f84f47

    SHA256

    ff1e0477725b66ce42e94fa4e3750ca525776204e7ec00325959df5f1577ba6d

    SHA512

    eda9a0aba0f7554482eafce8d15cbbddecf52d4da12df4a63bd0118a0428a575c017af56b3413ab08205633b8fe8698806a12ccb2dcc17eda561643cd10daeb7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4253243ba7265488be2274acc349a2c3

    SHA1

    6a4f6829cf816e2afb86f4d0206ba7c8d49188cd

    SHA256

    115d9ad31b9c7065d359044bbde64cdff0a421cd245f82fe94217e978e746048

    SHA512

    957b16eeb177bcaf46f0482d7b8cf7b80666480f866cd7d0dc994f61400e1715471eebe5fd4e58197e9db4c0a69cff2df8fa7a37df27c9780ff8e32d9d7e9608

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    50ac49a02142a4d812517d18fcb6cd4c

    SHA1

    094f79e3cf4510a4d97932c01c71999f1812a3a0

    SHA256

    357cf772e70c807720d2cef6b006d03e6006c488baf8710d169cd3ca768ec638

    SHA512

    67757c40e408c356d5e8f606cd74683c2973b843b652a162b4cf309dda36bd0729fc65d89ab70c1e7c8cb1532b12260d333a755a68bcf556319d51b59e84ab46

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ea425bba074c9996bb32386513ad2075

    SHA1

    fb71a3207a7b8451108b539123dab3c9104f70fd

    SHA256

    6feb751c4ece856e7b71203722bc472b653b8bac59f0f08edfb1fdf873b50def

    SHA512

    c69a8c618cadfc9a4ec5c562556797c5e8d826b1710745d93f6e10291cc0960132b02eb05710d3506eb95af3d6cdf3d30ee46267555bb489538efcd8d17e1ba7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a22e209945dfde901b0955314cfc4dfa

    SHA1

    8898a39be6e4023549949d047ccd2ec16ad6a2d0

    SHA256

    1ef3f92554716b2032662964ce201394394090b8da521be0e881d1e61ea8f907

    SHA512

    bf6b041c17e03e61f4c5c427237cf0fbac1eaf1f5140ec125f1537c1f5368831dc27dc3d41a4af3847ae910f5d9b3b5fca8280abf899289a80ba105aaa540c1b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    da10f4b54a1195eec8f8365f3456860c

    SHA1

    cc78f0f6e8afa83ca208ab00300329c51ee22ef9

    SHA256

    2d919fad710a4d0b61eabe5cd5c262e7b7a97ef15ca7e9054b06594ed057977f

    SHA512

    17c93e6f41c8e5a8037eb149f1bf7c02caa13614c211f2e66896a27f67790deb985f972fa9ce045669ad677f12ff9a9d29f1d43b1a0b2aef2fb1f2edb4b9b966

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2bea1351e6e2f60b3c6a6e2ac898c879

    SHA1

    575338f347b6706eeb8a5d5e0312df196bcb4281

    SHA256

    74f68e29deb9c22ef6209e15a8b710b1f138a9e7e7cd1f82ba3bf434384c1aa3

    SHA512

    91072f47ca1dfb0b98754a31880690aa4bec6ff60e307db429a211375e7bf5ea996323b745b58e2bd42f05d4d4cc0ca0c914500b0f22a175b36a50eccffcf9cf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2eee3e5864341e727245e0ec4b72a651

    SHA1

    5a683ffaadf73bf1e36251252078fbfc49d3c89a

    SHA256

    e430a93ecea1280227407c2c8936328d71f4cb4f17347ab3f0c2c45aee229702

    SHA512

    0badf2a29b817e1a4fa0965a481b906a279bfdc5fe3ee5fa387fa07770c0c75709da1ee9b49c0952859e2e3ff020c7cab94e460643494041f5d476472d3c1e7f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bea3fde75c2c200c5780559a603f4754

    SHA1

    99d9808361cdbe3dbd9b09f4ac18aa3af8f39ded

    SHA256

    e15c4f318420776f9579dc2f664d984ce325c7b8aa75515f56390fbcdbc4b29c

    SHA512

    afcee4067d49b0998ab0ddc795988b3388f128b654527cdd5fa8dad53bfa9bebc0dd48f2e62c71c9ab2b7d742898bd7c85c1cacff0938299dd1c468e25ea4e0d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    125368f6f012337522bd7e3340fe990a

    SHA1

    3defd4e5cfc8d1bf3e5d886f7b49a479fdcd9394

    SHA256

    c2bdbadaacd3d2cead83855ba3ac110d94db323bac90dbc9751463fb69a2d914

    SHA512

    925fc89a790bef2d9c44ea07a7fc7e3774ae0abb2870b6877d967b8cfde0357a65a0c6b0f580b2162de1c56e69dbc8487bc63388d613c961c7f7e0785432cc73

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7c640b265e5af6a9692974df1aac251f

    SHA1

    68159f3905bd7bda1f02f3ff8e2b791089769b1d

    SHA256

    56cde79df69cfcf56b2504ba08c617687c870732d6891766f6a0028cd1d74340

    SHA512

    c6ff2f5d68b28632cf5b5c8c57d99cd0b15482d98565b6adff8c60319bd796153975702f40245b3998651a99d42709b2d5402f2e0b1837d6a0fd361ca827aba0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    70a666cefbdb12226dc0edaac5f541a4

    SHA1

    aafd967bf6804faec6c4623e695388a0049778e8

    SHA256

    8f4cc54289e786edb1f5c260cef22404e59ebf93ca1a5abff90cb3af8a2615a3

    SHA512

    32b37f37415e595eb104567706a49040768008b89ce37a072ae3a0c645083e89990046b588c49ca699e5ff1aa68e8a9241287a2167c9f111c34ca687ba23ef90

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cb9a62726b3102e79fbf0eb341275564

    SHA1

    7e8a30a42bf186a1f6dcf6307f8a14ef9df48dcd

    SHA256

    34272573cf482b88ec244438046cc89fb93e732786afb2c133224ef8156e193a

    SHA512

    c906100cf2d3fc0d046f0ec5c334aa69c49ae820e21574b0d2c5a95a9d425a03d5d3703a52ec6f4e9b944fb7174b276f6bf38077007ed67ca7b320ccf0f50d79

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    59a02062497668966a92b3aac472bac4

    SHA1

    ce5353465758f0553eb94dcb7e77799a45bee6d0

    SHA256

    52c942db21bf832bda38bfa6802ed2464a8e729de96c1291eb1f43596a91b8d3

    SHA512

    65a6a3d05b45325eaec71320213c211e58e265812d1e401d1db38ae66002aa68b0fee0d24e1ff3d5cfeee38764a87e398a1ef8144c2511da948229c75baecf83

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4a9d838173eaa4d0c10f3829976299a7

    SHA1

    14e47ca40b6262820b091bb63b34f4dffd03060e

    SHA256

    0bda22bebdaa5780093c4ca117e4f59482215eba1650e16bab231edacd259e10

    SHA512

    56b7933dc19da26e1994a75ad99fcd74b23a7d79d3895f96f6869d9a896f06c762a8b38d4d03c02a0b9328662ade2d0c4b47c841c6f6cd41edd5254665e4c50c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4093725479aed89a3b8446d8ba840e1c

    SHA1

    1f054204ca38bf5c7627f450ab4135bf64e808be

    SHA256

    dfdb051b20953c73c2845aa2841451e85b2659f497b59d0442b86207ccb0089d

    SHA512

    0fa1c69f31d413043b68489e552b39c4ed96a745d0cb6b942fad43e7db934d4b1f0669b3c95da1633fa619283fab1678ba0c8b44108ecd471499043397faabf9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    80ed179489951932cb89c537022fae9d

    SHA1

    c4adbd15aa83563271a70ba1defc692f45d83dbf

    SHA256

    f30562883cba9669f4481236ad7298afebaf2fa87f25f33d2a32a9411540c1db

    SHA512

    86110c47270f57951b3617cb29f65842eb7aa383f5247a0fc325a8538cb60ccda39875af0ddc71ae8ea72432adfe77c390748e59a90aeb6c2e2e68a188bb719e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5a39a89be3b86d72ee35850b0942261f

    SHA1

    f7dd00dd194f8291f94eb4bf1ebad43ce344d51c

    SHA256

    9f749dc31b0d96393232be26150307f6822cd15ab38b2466bf5cb19307058acf

    SHA512

    27e339a661810402dafaffdff1e4b93e4a7d4319320431dab66ee624e1fdaff7b806f4e1a5b562811a7013055aaaad30850ed0a7889e54ce967fb7e96f1d6482

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c51272e897af4b4499e5b753dccce53d

    SHA1

    3b8c359db894e88fd30b07a150b28212ee7206bc

    SHA256

    84d6dae041b434cf0a921f5e42948fef91c31cd7e84594f91cc8c4d4ae34cf9b

    SHA512

    52d931a6b344d69033d8337b81477fee2aa227b2b719a0e07d0ecec7b5b66dea6515f7d4579d80673da382856a2d38c5f0c8358e7f1948f5957b9dcd1ac7ff65

  • C:\Users\Admin\AppData\Local\Temp\CabC746.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarC7A9.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\dfDelmlljy.bat

    Filesize

    207B

    MD5

    22187c81105b43ae78940848cea05cb4

    SHA1

    ac62d6e506a7353881bc9cf827895d93ac987d38

    SHA256

    73b0158ee44a774981a7fe2d30f89adb0d590126dadb95c0e6bbad9a1cb02a04

    SHA512

    b00d1d924314b49e1c3d3d37f28cc3f82583afebc55d546d549b58486bf9ec9ffd15d0f0fc970643989215a069a0965bb8702c04468e8991015c11dbb6a12377

  • memory/292-20-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/292-0-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB