Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    06/09/2024, 14:14

General

  • Target

    38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe

  • Size

    330KB

  • MD5

    ee1b0e6423386f2c53869725a16c24ae

  • SHA1

    c3a06587bb81b375b1f1b606e279afb41150a26d

  • SHA256

    38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc

  • SHA512

    61bf4006cca47161050b335b42db5e0943b892848920a24e4c3334f76d93ad18951647f1d92c942c7c64b170027da5775b7ea3e2cdb04412a31a02f1fcc9136d

  • SSDEEP

    6144:fxYrRwGrWwNDCBC2iDFOIh10+7vdX6Ba/AOIPb+PqR/J7y12:fxWrNtDFf1BrRHhiR/J7B

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe
    "C:\Users\Admin\AppData\Local\Temp\38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\SIAMIT~1.EXE
      "C:\Users\Admin\AppData\Local\Temp\SIAMIT~1.EXE" -hwnd 393504 -uninstall
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -command "Get-WinUserLanguageList | ConvertTo-Json -Compress"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2988
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 560
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SIAMIT~1.EXE

    Filesize

    117KB

    MD5

    5d77bda9abaf2d713df2fb3b7db4860f

    SHA1

    64a3f12df35235d18d4af16f709bf2c03cb88032

    SHA256

    865e73bc9f80c58fd2795709b549dc8fe8e09f86af6fc11a039cb134d4657419

    SHA512

    0930ccf6ff6fa3cf0ebae60e69e226270f2ada40df5a8b42f5ad797d79a23618e6d632ca90ded9eacfc3905f6bee2d6db42f20b04017cfbe674fa112e49bd8b3

  • C:\Users\Admin\AppData\Local\Temp\img581F.tmp

    Filesize

    26KB

    MD5

    0ee5c85d988e567c0fb740eb231e5e81

    SHA1

    713547ca83b1c416603b8cc4786290af9e983712

    SHA256

    e5ed3d2e0ba8e5e0a17b8e8e45b42e1a5d293e977c79c1856a6314bddcfc4389

    SHA512

    8cdef4628ef05803eb38ce30546ee0099611f7fa1458148924cccd7e024a1c6fd8930909b42f8fa500b4dc3d2b3a8b7ad60a51ab72b6a439c1e080ae9864e9ca

  • memory/2676-24-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

    Filesize

    4KB

  • memory/2676-25-0x00000000012C0000-0x00000000012E0000-memory.dmp

    Filesize

    128KB

  • memory/2676-33-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

    Filesize

    4KB