Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe
Resource
win10v2004-20240802-en
General
-
Target
3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe
-
Size
2.7MB
-
MD5
f6486a530d39541ddd6d9aa8fda39efb
-
SHA1
f98c06a6d964599124f607dcb450aa30e1dedf6e
-
SHA256
3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299
-
SHA512
90ac1dc6bca6d0dcde037fe6a991a4b4f9b24f88427c70f4009da0ff89615e0ad92a26a86f92071598943be030e716e1c60c9581afcde3b837ffdbf07ff6d014
-
SSDEEP
49152:WrXdF4A9mZwpwh36IHASx2MxxEE98ZG+4LtLwhv/IqjvF:WrXdFeh36IHASx2MfEEVl/q
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2076 njuesjrotk.exe 2260 njuesjrotk.tmp -
Loads dropped DLL 6 IoCs
pid Process 2376 cmd.exe 2076 njuesjrotk.exe 2260 njuesjrotk.tmp 2260 njuesjrotk.tmp 2260 njuesjrotk.tmp 2260 njuesjrotk.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\MYPGNotes\is-9TPNC.tmp njuesjrotk.tmp File created C:\Program Files (x86)\MYPGNotes\is-CGMAR.tmp njuesjrotk.tmp File opened for modification C:\Program Files (x86)\MYPGNotes\unins000.dat njuesjrotk.tmp File created C:\Program Files (x86)\MYPGNotes\unins000.dat njuesjrotk.tmp File created C:\Program Files (x86)\MYPGNotes\is-1VQTG.tmp njuesjrotk.tmp File created C:\Program Files (x86)\MYPGNotes\is-9I4H3.tmp njuesjrotk.tmp File created C:\Program Files (x86)\MYPGNotes\is-S729V.tmp njuesjrotk.tmp File created C:\Program Files (x86)\MYPGNotes\is-4H4SO.tmp njuesjrotk.tmp File opened for modification C:\Program Files (x86)\MYPGNotes\AppleNote.exe njuesjrotk.tmp File opened for modification C:\Program Files (x86)\MYPGNotes\Qt5Concurrent.dll njuesjrotk.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njuesjrotk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njuesjrotk.tmp -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2428 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 2428 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 2260 njuesjrotk.tmp 2260 njuesjrotk.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2260 njuesjrotk.tmp -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2376 2428 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 30 PID 2428 wrote to memory of 2376 2428 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 30 PID 2428 wrote to memory of 2376 2428 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 30 PID 2428 wrote to memory of 2376 2428 3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe 30 PID 2376 wrote to memory of 2076 2376 cmd.exe 32 PID 2376 wrote to memory of 2076 2376 cmd.exe 32 PID 2376 wrote to memory of 2076 2376 cmd.exe 32 PID 2376 wrote to memory of 2076 2376 cmd.exe 32 PID 2376 wrote to memory of 2076 2376 cmd.exe 32 PID 2376 wrote to memory of 2076 2376 cmd.exe 32 PID 2376 wrote to memory of 2076 2376 cmd.exe 32 PID 2076 wrote to memory of 2260 2076 njuesjrotk.exe 33 PID 2076 wrote to memory of 2260 2076 njuesjrotk.exe 33 PID 2076 wrote to memory of 2260 2076 njuesjrotk.exe 33 PID 2076 wrote to memory of 2260 2076 njuesjrotk.exe 33 PID 2076 wrote to memory of 2260 2076 njuesjrotk.exe 33 PID 2076 wrote to memory of 2260 2076 njuesjrotk.exe 33 PID 2076 wrote to memory of 2260 2076 njuesjrotk.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe"C:\Users\Admin\AppData\Local\Temp\3b8ff2b8bbd9d56a3091740f19b58114d35db44848dce67db685c864b5fc3299.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\njuesjrotk.exe" /VERYSILENT2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\njuesjrotk.exe"C:\Users\Admin\AppData\Local\Temp\njuesjrotk.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\is-CN5RN.tmp\njuesjrotk.tmp"C:\Users\Admin\AppData\Local\Temp\is-CN5RN.tmp\njuesjrotk.tmp" /SL5="$70150,232785,54272,C:\Users\Admin\AppData\Local\Temp\njuesjrotk.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2260
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
526KB
MD59beea33ea128fd25ad509ae7ff7bcff3
SHA13a87a124b47d68bf8eb1d1a4f9695fb2b2a52660
SHA256e0634bc21490c472b233aaec047438feae557f0d57ea5b78b3b48260916e2b4e
SHA512292996177bbb804ea3f6ad51fdb74707f1a1a35d50d8ae7b082d88cbb476bae1a883133c9e1dc4cefce78bc71f8d65276e5cdaeeef03088bc54beb41269dc5b3
-
Filesize
355KB
MD5b9f2020458f930f4ca42b1476646eba4
SHA19c083e6c51efd1889e9d3022166f8107cd72f2b4
SHA2563faaf4c99a96bc7d65ed14d2684856e0daf2573541d576d6f4ad4164f888553e
SHA512034324c4c2f189212ea4002cd3ec7342d665b1cc644268a4b1af78ba7b7893cb8443ffe56909d813756a59dc237c4248467b705667e7a01e7e3912641198995f
-
Filesize
907KB
MD554be4f878781796c5a7b4635b343c4ef
SHA116b9a435221f5f49284f56142a7bbf22c8f0c9f7
SHA256ec61e41d7aff21b1b473530a6c86f4cafaf24ad6dc659d20283e081e472c51fd
SHA51248bce9ea6003de2cf3bc273da3e941212f93840608cbb4c114ea0eeeb6616fde8aa448430e2daf8729893a3b4cb8d8c5dc3a6e5316c9ef6bd453ee7b6f14df08
-
Filesize
900KB
MD5f8b110dc2063d3b29502aa7042d26122
SHA11a0fd3db79eadc1ce714f6267d476ddbec0f5e79
SHA256e8730b0bf8f94cbb8babbfefb32cef8e8d19ec823f28c33a7d48c78589710762
SHA512f3125d3f575aff68105ebb3eadbce30547d34e12237d8ebbc555c6fe12bcc0a5ea85a38e26f2900d70af70ec07efde3b8cd65dc0fdada637496531245ea5052f
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3