Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    04/09/2024, 13:36

General

  • Target

    3551037b428548213f880ee755ca2390N.exe

  • Size

    422KB

  • MD5

    3551037b428548213f880ee755ca2390

  • SHA1

    559ac9a2afd252e1e42c29d329272ab44cd889e8

  • SHA256

    8a1bfbc22006c9c49579fb9e101c4a5fb75c071b13b05a743aa28e4541976461

  • SHA512

    e310e2d2f969902ae7dd4746dab6c72ae7b86684334c903d70660a45fdfcefb178ceec491f17cb9d7aaf9813b35e71d5c425ef2e3277eb26c31af920c783feee

  • SSDEEP

    3072:AYLf3GqW1ywnfwdiEu6+7UPToMVsPARgW/TCD5uSYzZPXQKlU2k7HoZ7WK7TxqNo:AirW1n4d//PTJOYRgsTxFxU27WGYhRnC

Score
6/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3551037b428548213f880ee755ca2390N.exe
    "C:\Users\Admin\AppData\Local\Temp\3551037b428548213f880ee755ca2390N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Users\Admin\AppData\Local\Temp\PostUpdate.exe
        "C:\Users\Admin\AppData\Local\Temp\PostUpdate.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious use of WriteProcessMemory
        PID:1120
        • C:\Users\Admin\AppData\Local\Temp\processlasso.exe
          /postupdate
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1564
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {291987A5-C68F-4462-98E8-25E1EF91F5E0} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\bitsumsessionagent.exe
      C:\Users\Admin\AppData\Local\Temp\bitsumsessionagent.exe ----------------------------------------------------------------
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    75eab038d715f28d32b20e1dfc71b90b

    SHA1

    cd9cb69cd31ca676edb4bda819d36109bb431e59

    SHA256

    ffae1ac5b97c762522ce72608467bb24e96a5a12e6448db36f57ed1b982bcac5

    SHA512

    66164ae74f0fd5b8791d4f1f6ddec0b3d9c21832f481fc4291f570a6e5fa91991f9ccf63dc35d234011d29eb35e185e4cc3f74d721c9ea3aa54e6e3a58860a5b

  • C:\Users\Admin\AppData\Local\Temp\CabC766.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe

    Filesize

    1.6MB

    MD5

    0790562361cf733a7ec381a83b815681

    SHA1

    7a9364049718b6a26141d717b4c918cc22084d77

    SHA256

    f44308768b7145b11a9ce52426528c88e221b47fe8d4145f066e734e1c60eaee

    SHA512

    a6bc71fc5de83228ebb6184e9469165de0bac201d488ac41011acdcdc0c1a6bcedac62b0e10880639027459a1a15422156ae43a05d808901975467b3f5cb2bbf

  • C:\Users\Admin\AppData\Local\Temp\QuickUpgrade.exe.Replacement

    Filesize

    422KB

    MD5

    d720f448ea02b3c7e2b7291b40f31ac3

    SHA1

    2035ce95916c1d95867d0a6bc035cee068f84d30

    SHA256

    f8d3768681d2de474fc78da649ce02662d1760b8cb139b8158e1438cafd42baa

    SHA512

    5a021ce5d0b0790efcb560b7089404b744080b1f9f8e5fd05aaf9d557b25b6c9e649ef69a9a83261d0a3f1a368b2898341929477ffa774c8dde6cd97e42efcc1

  • C:\Users\Admin\AppData\Local\Temp\TarC7F6.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\bitsumsessionagent.exe

    Filesize

    141KB

    MD5

    9fea26f0f8751f6c32f9b4e47b5b957e

    SHA1

    f75de183a1580d8662da086c72eeaa4aab7c21be

    SHA256

    562937de703f04771ccd4e7bb0c3ffc38c22d2e2bb44d8a7dfd0a7663a6c6e8b

    SHA512

    e4421b9fb4c0c6b6514715353126eec1e4a61a28e36ba49b77a8842988e40a606ecab1096f7aaf1e5e44c0547732616bf5b0a672974086d0fb673a5033aa4d11

  • C:\Users\Admin\AppData\Local\Temp\pl_rsrc_english.dll

    Filesize

    1.9MB

    MD5

    ff7ffcf822b20dd46a6ff87868e8e3ec

    SHA1

    2bf83ae40009f2b365eba6a339b93626dde1d8a0

    SHA256

    0d5e766156f38a7a626e9bd101bb8010cf480b7d0d6c2a2c9391ed1e854493b2

    SHA512

    474a487e937d461ef3391ccf6a9ab678a3b5218e1768b22272b74a9fafe8144dcf6318258a7b9e8883e61f144c30676eee64af3573bef6ac18f122b1ebaea770

  • \Users\Admin\AppData\Local\Temp\PostUpdate.exe

    Filesize

    627KB

    MD5

    76a0b3c6a81a8b8c454c9a9d26e60b01

    SHA1

    363985917da4235e1af5c305f8413cdf23d96821

    SHA256

    7656417fecc53631a163061c9ec14bcdf286d1a5a5364eef34963c3a836722d6

    SHA512

    6bc4a9f616c847ed92cbbd882c47b8953efea5d97ac023f2525784eaf6e940686f2ddd1bea2a55134ace10e7de72fa58c02912ca6c6e5005d5a2997b6bf5f34e

  • \Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe

    Filesize

    2.6MB

    MD5

    898a1344f19966a14a8c087ffc7226db

    SHA1

    88882e1f04d793f4d2e1855b6c70174f08fbb8fb

    SHA256

    ef28f9534b9f44f6010337b7323c9afbf647248bda524216103b797972e5ca49

    SHA512

    812716ee4e5f379a809ece3b48eb797f448ff52aa250c4bfc5c4111c8c63d19c9dd92eab2d299a7848206d959a577cf3cf1b0120429535c4040a4473732d463f