Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 21:13

General

  • Target

    usermode.exe

  • Size

    841KB

  • MD5

    f8b0de77396a65e55a6e3a3068d81ef7

  • SHA1

    20e3d74dabc53283682362f5caa66427841c009d

  • SHA256

    902c4af63b5c77e23636001eb59eabce31380d2e310e483f03b5f2d40f1bc5b5

  • SHA512

    db8789a2f8702a722f2ffc91618960ef2783c6e18cfe779ddadbdeec77d30d40af1e82ded426414dc19fc63d652c1f98a7de51744e2a11ea845105a736dedff1

  • SSDEEP

    6144:Xt4+19w1q16E2LHDpTP/20QhFOeuGfniPCUnyLc4MpHwKV+yjSbw/Wlk25WBqQU/:Xt4+8zz1z/QhFZfniPTMDOyfu2K

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\usermode.exe
    "C:\Users\Admin\AppData\Local\Temp\usermode.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://discord.gg/saturniv
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1988
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:1452
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c color 5
        2⤵
          PID:2608
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          2⤵
            PID:2976
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c color 6
            2⤵
              PID:2904
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Windows\System32\mp.exe C:\Windows\System32\dr.sys
              2⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2920
              • C:\Windows\System32\mp.exe
                C:\Windows\System32\mp.exe C:\Windows\System32\dr.sys
                3⤵
                • Executes dropped EXE
                PID:2892

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            5e3d85e306bb987598f1018326a2cf04

            SHA1

            bc9e25ef97e81baade436a0456b030599bb08a8d

            SHA256

            e36a1307f57c49ee8124c7c24996d38f49dd9dc141b92a73b6a9de6d8e07f2e2

            SHA512

            fb92f5e00ac829a3250ef6ab9f93ab77bf3ddf1fa5ea416bd041cdc562ae6289644feaf81003998314403af5ed05cb1709967330f07ca38119443d972e86eced

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            318f87b6c758981ec955a4df30240c66

            SHA1

            eb4ae4430cea2d1d84b55102d0f8deee462f8dc3

            SHA256

            08561bba75e27556bc5282d9d8f5d3f46bd075e0f9c38af6a888e1437c128c12

            SHA512

            ba34b3822e26ab946e08445276f2565ea1d0821093e812726b19d3d2bea3f4a20292de01cc9f2e2392256357d92468ad9a199b29f5f93480c29b9c7a098a6e81

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            7ff837322c955489df2cfbb8713b24cf

            SHA1

            92f2d7432f0f83966616204ff579ec6818e0fc23

            SHA256

            ef8603448bdaa49b11393eab75ad5aa7ec4fa10c82b028ddf1af5fce9cea49ca

            SHA512

            1a8fba5a5a7e27e86c53e8a4d1cb29333dd022a03d3456e470903b18742896b1367bbad19e5fcabe1a3954855fbe0a42a23b5877bb22fb73488ca43837f2e3d4

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            333402236757af8a022deab0f272c81e

            SHA1

            4b1be08dbd83a7ef065d0cdf7f700f5ca19a0c53

            SHA256

            4833f29abeb137311133fb33bd241078468ef852d00824ce2c9dc9cc38576ec1

            SHA512

            9bddd69a50ba4bb997a703761cc52252d37419ac4c44de5e3bf74adf420424026eabedd1452f27178823f8f05d03480a420005f07a2a166f6d581c699d2ea6fc

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            656084ee8c580dff3c2c55a525c19216

            SHA1

            e836adac5dacd72e493b9c8629e6fdd944b779bd

            SHA256

            5cc820bab9dfb359d5ee86d421873081c4140981bac53844255820858f1812c9

            SHA512

            e3c5b67c21e93fac93299cfddd75d24c35233cde7abf10406930bd3cdc0e2ae28cf2da59116caedd6f3786427ebe068ba3ba140a5df9f573ac699f616fc4a838

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            3cdca50ffe0d4e6ee6989b9a9d06e0d2

            SHA1

            ca51703c798bfabfa4d39acaa372323a4d99e7f0

            SHA256

            8037571c7701981d22177fcbff1349785075d7cb8d2eb6705cc18a6cdcf44048

            SHA512

            12bcc93bad952dfa8fa22bfa0f738193d09e7849a02a3d3ef7f2c872e7f3f6fce28c6aa5b63b493d317bd142e907b7038055cf8ece9b91b8a2caada561a9c363

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f312808c9565d84819754325b9dccf52

            SHA1

            4283cc1c4e3985b700abb1e7b75e02304b879820

            SHA256

            23756b409c089be93396808bdedf6e2c3a3decac8077f1ad2eea63032f95a140

            SHA512

            9441eba12bd727134166b2f290155f8ddefb9d2a6f11c1f170740ed162035a0aa055abcaa4fb518bcc2b7c17bca4934a11f88bfbae83a6f4c864574f1e5716c0

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            137eb98ae36dc70cd0fcae859acec073

            SHA1

            c60c8a247146384da3bbf7a8e978a1acc84182b6

            SHA256

            1f47ca6c06bd9cf8fa837fc0e6b42b0ded6dafc9ae04907c11909d40a1b84cd5

            SHA512

            fc8394c1d36cf0c262c17cc2f507fde724957935ef7cbd1302313a9b2652d9e56b923a0a9a82ebc447dbae586fd2b440b56c129c0116e84c5ff417eea6a28917

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            25e9bd53a17db0935cf6e894e808ca94

            SHA1

            41d1a6c931e9c395beb8e4bd528b66a2dc0a736d

            SHA256

            28a2d3faaae9075e622c9fbea1aa6a3d8ed74210fa488f5c303060fc20e96f1e

            SHA512

            a8a462879edb2ebf31e48919ffa303ea862a9201e4baa71a2e2f64c7cc10c15a01faef577df1acfe71a98bc1e9e1908c4da37e1db248021093ce38f332d17f63

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            d4f4c8838536b157d6063f5d9e81910b

            SHA1

            2187829af2a72c38704444b59d2d2cf222a3d464

            SHA256

            f3d398254944343d5a5a2c5172eba8470efce7ce3de1b81cc9ea91af0e7c8f94

            SHA512

            d63cf4cd71c6e5e88c0114441a35567a3ec31c74cd1d18a87c34cd73922dbd06e0fe49ff1b4ec424f57b64b6660a778749f6b186f028ab8a108c20ce0bd72547

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            cd4eadf5ea03a098fb6f167b8932131a

            SHA1

            84e73ae89a0f02a33ddfc3b7326b00065edf947a

            SHA256

            8e26c2eab0f560245118d2bb59aad37b573696692d8fffd9c96f7ebc0084325a

            SHA512

            228ce2340d9ea512b2292ad324c525bc503c283df714de5dc1ad6fd4981fb98c1a8265262df127dfefe9ccf4f383f4c33ce9fc8597bce293da62ab36ac6d7c5c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            bffffdb03cc566b7b0db528f91493686

            SHA1

            7fa9800aab80f9dbc6e222704bd99aca1ee9f6d6

            SHA256

            9a3bc8a57b39f5f651e23de7cd76b5a064a924702e26fde16272cf562280fdc3

            SHA512

            2c75488b71719cbb0e57153dcdc37b9edc9c5ebda07f27067c69e0fb558b3eec643b586871144ed038bdc4ebe25821118a7068aac5506bce45ea3b75e176e686

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            bf5a2460980961395f01bc620aa4fa2d

            SHA1

            30aec3fd4b72a535666917284032cac6505ec383

            SHA256

            79e412512198f14d6f8efbd9ccaf9c4b3a1fe3f2fb5e56930f5f52ecfbeafcea

            SHA512

            5d72784a8577d5f7a6c9978a35c61e5b19ea4d0f119d3c0294b2b2bb22bafa4b76b20a864a90352acc882042e8eb49be3d4b16a3273cdab261ba2159f4c010b2

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b4629ea881215035e7f34b1a5a179e53

            SHA1

            71ff49c3aa773d8f3c100b24373673556998261b

            SHA256

            3783a4fea7b8ce7695edf8bb77167896531f3896caff2a27f5e1d1c27d22cc20

            SHA512

            b8c234b486627d697ae0dcd2cd293af245f795a6139808521d318181ec94974c0eb8d70a3b4f5f16bbd608eae8b6e42cb0f45a1d1a66c1e7b529a53ffc164ba0

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            5c0ec1297232cb33a35c4181b41f128a

            SHA1

            9f4520ef0d621067750966eaf663e297e274ad43

            SHA256

            47fddcc49441bedd19febac3d3fe0fcbf1b65c66d6ee00e67babadbda43434b5

            SHA512

            796ef06a7ffdca9ed6220a2635bab53d29303a0683276b24cbc4e73c1d8fef9cd3413ac00432c448a80b91d78e80edc134bb319a75799e8752611d3f0dc1e3f8

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            43b4df3af665b30d0d050063ca384a01

            SHA1

            6d076804d1cadf2826e2efbf16e426d9e0a2dbdf

            SHA256

            5ff4ccb0a375d882e3dd03f176c5a72e0d69c11551ca370c0c99aa80ab57753d

            SHA512

            6523f5060d3db8611c4883c78489913d9ce46b4f815c031d7586e4da762baeb1702164d8147fbe141f3bbf18b147bf888d45e06d0faed329d5252c7d4660759e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c79b0a8bc4b61bcb91048c85f3c9790e

            SHA1

            392333f568e048b8f2980cc556975fcc6efe34a8

            SHA256

            4d4f187fb81dbecf091bf6c17a5b0c4be8f1197ef1aea8684fea8b4a3ea6bea9

            SHA512

            5422e8104c9a28c255a8a2d5f9a2eb4e25ed8dec00e4afb9894c9180a8fa24cccbfe448cac9ad28b7cae3676b31c4806420b6c8223add9ae1907025829f76f0e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            e8727a4540bcdba8ca1c59abb9e7b877

            SHA1

            dac74953f3ddf5ce0c65a8352498c1aeca8fbf5c

            SHA256

            11efb7002726e6f56994f27664bca9300907e57f4a5569ee807c101191ad483c

            SHA512

            6d39ff80e76ce2489620d1527b984cdefcc3797bd7257b40890ea32db646d8d3508936d360ddb10031acc703861350eaabc7a38fbc33653d50685db0e2fa4d49

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            a323867b03bd8099dad61dcc75e7e82c

            SHA1

            15e6d45fc0462c03edda5c642cf905950ca2c3a9

            SHA256

            f589abc869c318e791c3fa7989aba01477cba602bcdb45b27ac1dd6a4ba54941

            SHA512

            afc5f45b0f453168a228f87b8dda9679d8211a3f0e23e902f065c4dac4bc4bda4d645a2767cc7ff65b8370ed1610050bd427eec7c894948bdc68317b2be78dd6

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            81b8b15b5c44053af0a74b4ede80bb2d

            SHA1

            eb6514ded273d9d849498c0ae4b70ddbf0ddd4be

            SHA256

            7eea70e50e99b171902220097b6c716ef822371657b8e9d3ad6fd33e4ad16d36

            SHA512

            114bb4d449c69fa93972faa49f31ebcb0390e0a886857d4d0c37e22c8623c12d77aee2d1fd1b918415eb8e62e5bbb0738c1348ec90c31f30f2c582dea788518b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            b98371196928872d4dbd1118a21d37c9

            SHA1

            630ba20bba6dfec5fbc381a9e34eee031365ee8b

            SHA256

            e0f78252e6cc1ceb095b6136c415253e5d2f3546b0a3d80e0c7ad287736ad698

            SHA512

            7cb89fdf8011c35fae6f8924d270f236b09f2dde3df1c627d603c144ef48aef327d4991ea770258bfb547927d9278e3981e4456643ecd58f1f2369bf48d741e6

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            57500f537d0b7f687ed2205807867a53

            SHA1

            2d12bb3d4ded85719f5dae5c674e0dad1b73b864

            SHA256

            18386b2ec66e2215ad5ed039aa7152c5a1752ba66c2a4f9682edb4ed36692f2f

            SHA512

            e2f17054a6afcbff086fe57786f492a9b3c2be2e010150ca3dbde707236825cc92ec89afe9b7a28cfdbc7ae1a1eb102a0f58226cde404504bf067ea11fbc0335

          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\njqq61f\imagestore.dat

            Filesize

            24KB

            MD5

            c8576bb3ae05306f62283633878ca525

            SHA1

            205bce7159fdd487efcec5440b0f8a5b2727cc6b

            SHA256

            9bef29179cade25a640f4ce8017f604720b637d66022b68bee5710f12617b2a6

            SHA512

            da193e0e09387206b4dbc15339a5210dca2f889cdfbb04f8bcbb4dd7b731f327b2e679adf68699b9883d9f46aed654590467d0c5abd5ff36d615585b01d17cc0

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\favicon[1].ico

            Filesize

            23KB

            MD5

            ec2c34cadd4b5f4594415127380a85e6

            SHA1

            e7e129270da0153510ef04a148d08702b980b679

            SHA256

            128e20b3b15c65dd470cb9d0dc8fe10e2ff9f72fac99ee621b01a391ef6b81c7

            SHA512

            c1997779ff5d0f74a7fbb359606dab83439c143fbdb52025495bdc3a7cb87188085eaf12cc434cbf63b3f8da5417c8a03f2e64f751c0a63508e4412ea4e7425c

          • C:\Users\Admin\AppData\Local\Temp\Cab4CFA.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\Tar4DC7.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • C:\Users\Admin\AppData\Local\Temp\~DF9AD762E6CE3D6C92.TMP

            Filesize

            16KB

            MD5

            d3de7ef68e87ffb18977ea5251acec22

            SHA1

            75e308acde823a3c5f2437abdfa1cc98ed6b3177

            SHA256

            08537603168460778f3eec66b36967724cd1aa716e07e716bbc24db31a2cffcd

            SHA512

            58d00b6b0c38ff8f8c0ae3096ae197acc2e6d49f2c4fc1f38e4555a5edaf8f5312770ddfffc1c2372ca6855ac2fc47bce488f24e51c34fd9b4312091c92ae5d4

          • C:\Windows\System32\mp.exe

            Filesize

            530KB

            MD5

            54ed683eba9340abf6783bd8d7b39445

            SHA1

            950e3c11c71354097c8440529b31f8ac2b3c32a8

            SHA256

            2d0a9d5ca563ffa82a974903bb43411b22c863311ec926449f08d16f483e4e70

            SHA512

            9ff8c110823bad1e0a79a810b151e1d5557022080af0c8aaa9ff76996bd040747346f62459c50468cf86f49389c0e5fb7f057e9bd30fa31fed49ae5692d50ae2

          • memory/2892-996-0x000000013FB70000-0x000000013FC21000-memory.dmp

            Filesize

            708KB

          • memory/2892-997-0x000000013FB70000-0x000000013FC21000-memory.dmp

            Filesize

            708KB

          • memory/2920-993-0x000000013FB70000-0x000000013FC21000-memory.dmp

            Filesize

            708KB