Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 01:30

General

  • Target

    87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe

  • Size

    45KB

  • MD5

    06102d862a4a1aad9e0cc4972065a3b0

  • SHA1

    9197edb6b32290f31276b39a2af162efa7a65327

  • SHA256

    87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793

  • SHA512

    280ee6f811c8d2e9b153f17874fe56d18b4760fb20edcefffd04ae2428b35947205ecf890de64f59eb0f1f11fe488dee4f36dc7a7e31cc7071e72422e386ae23

  • SSDEEP

    768:5qt/WXwCXV/aNOFi5XOCmg9TgEqxZihrWS9ybsvw+I9D88888888888JXl:5UWXaMU5Xvp3FrbCEnl

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 21 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 28 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe
    "C:\Users\Admin\AppData\Local\Temp\87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\recycled\SVCHOST.EXE
      C:\recycled\SVCHOST.EXE :agent
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\recycled\SVCHOST.EXE
        C:\recycled\SVCHOST.EXE :agent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2800
      • F:\recycled\SVCHOST.EXE
        F:\recycled\SVCHOST.EXE :agent
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2944
        • C:\recycled\SVCHOST.EXE
          C:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2720
        • F:\recycled\SVCHOST.EXE
          F:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2636
        • C:\recycled\SPOOLSV.EXE
          C:\recycled\SPOOLSV.EXE :agent
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2892
          • C:\recycled\SVCHOST.EXE
            C:\recycled\SVCHOST.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2604
          • F:\recycled\SVCHOST.EXE
            F:\recycled\SVCHOST.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2676
          • C:\recycled\SPOOLSV.EXE
            C:\recycled\SPOOLSV.EXE :agent
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:3060
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1840
      • C:\Windows\SysWOW64\userinit.exe
        C:\Windows\system32\userinit.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:636
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          4⤵
            PID:2328
      • F:\recycled\SVCHOST.EXE
        F:\recycled\SVCHOST.EXE :agent
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:856
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2472
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.doc"
        2⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1240
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:2304

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt

        Filesize

        1KB

        MD5

        0269b6347e473980c5378044ac67aa1f

        SHA1

        c3334de50e320ad8bce8398acff95c363d039245

        SHA256

        68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

        SHA512

        e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

      • C:\begolu.txt

        Filesize

        2B

        MD5

        2b9d4fa85c8e82132bde46b143040142

        SHA1

        a02431cf7c501a5b368c91e41283419d8fa9fb03

        SHA256

        4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142

        SHA512

        c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be

      • C:\recycled\SPOOLSV.EXE

        Filesize

        45KB

        MD5

        4d93bfce6fbfffbc88e01be54688f5cd

        SHA1

        8197bd635a011631055cfd3077969eca7099fcfc

        SHA256

        cf8c1366188077df02839aa18a7e9a51489290225c770e44bd6bfc93018f3e4e

        SHA512

        6a4aca38609c29ab6e5a47cf8084858b5a0628a30221bd80f7d69c591f93a39cd2731b14fe5c9df80b3250bdeda4828797dc7e8f35ed37c3dc9c9470f35bbf0b

      • F:\Recycled\SVCHOST.EXE

        Filesize

        45KB

        MD5

        8c9875d01926a9e87b8c5a3426719ba3

        SHA1

        33cc5dc1e729b1e98c9692afef902d243c2afb4d

        SHA256

        c33d4cbbfafca755d5bbfc0d0d6994929aef260b26639b9d22954d1cca22a709

        SHA512

        341dbf0ed85897cc19d9af9905ae89c2ac3e14b33b003c924a1288b5d8b16b6ba461428582bd7f9bd2a854db4bbbad13e0f472a85d4662fd2ed8a81d12fb9805

      • \Recycled\SVCHOST.EXE

        Filesize

        45KB

        MD5

        c59c76afe89caa150154c3f455cc22b7

        SHA1

        56cb75fbcdc6ce29bdcb33410e04b7ce561282f5

        SHA256

        7b1019ec5dd45d5c10c4a74ab9363a94f0c7ed95d95a624a6b94557b041a67d3

        SHA512

        b1b2026b0a8fa617aeb1d5008c7869d79696fb41196dbf064e5f6183fa67f4b98368b815f2d31b3e4ba8c1490f01a1ee27ef4a7be923252932e43107dbb2c628

      • memory/856-96-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/1240-106-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/1840-89-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2472-103-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2472-101-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2504-17-0x0000000000820000-0x000000000083A000-memory.dmp

        Filesize

        104KB

      • memory/2504-104-0x0000000004230000-0x000000000423C000-memory.dmp

        Filesize

        48KB

      • memory/2504-0-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2504-98-0x0000000000820000-0x000000000083A000-memory.dmp

        Filesize

        104KB

      • memory/2504-105-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2604-70-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2604-68-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2636-54-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2676-77-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2720-51-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2792-126-0x0000000000620000-0x000000000063A000-memory.dmp

        Filesize

        104KB

      • memory/2792-125-0x0000000000620000-0x000000000063A000-memory.dmp

        Filesize

        104KB

      • memory/2792-85-0x0000000000620000-0x000000000063A000-memory.dmp

        Filesize

        104KB

      • memory/2792-36-0x0000000000620000-0x000000000063A000-memory.dmp

        Filesize

        104KB

      • memory/2792-30-0x0000000000620000-0x000000000063A000-memory.dmp

        Filesize

        104KB

      • memory/2792-116-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2792-118-0x0000000000620000-0x000000000063A000-memory.dmp

        Filesize

        104KB

      • memory/2800-33-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2892-122-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2892-124-0x0000000002470000-0x000000000248A000-memory.dmp

        Filesize

        104KB

      • memory/2944-39-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2944-119-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2944-57-0x0000000002650000-0x000000000266A000-memory.dmp

        Filesize

        104KB

      • memory/3060-82-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/3060-81-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB