Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

7748a7a639...aN.exe

windows7-x64

8

7748a7a639...aN.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 21:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe

  • Size

    2.4MB

  • MD5

    18a30dc10b5ec40019b53ba5c5170dd0

  • SHA1

    a48365f3f9d8cfb5279bbeb58fb7fd652a662503

  • SHA256

    7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01a

  • SHA512

    63977dae26929f09adb4a4c8bb1cb8710a4e79be058d4f286c027b4c27c3c1e4771db73a3ef259b55a902861726f0096f9ad0ad0b48291a24b51e887566caa9f

  • SSDEEP

    49152:GR/laMbYAp7s5nceEv7MuGOe4jPyTmE7ZIIKR01GSM8prnoo:GRNvpAceMjGL4jaCE7ZGCxh

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe
    "C:\Users\Admin\AppData\Local\Temp\7748a7a6393fc9998d98fefcda3c23e4c313067f50f3965c20992b3daba0d01aN.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    b4a60ef7d691703d483d3ec7eda73697

    SHA1

    ca200b0ef0c1fb7d26d30db3695c31d620b68885

    SHA256

    2f5166d09c98bd58f4a33e5b6de1bf20828082bee07c747d0a52dd91251e1819

    SHA512

    25bca8e65e2573d533d9899f4f66d0f6c6675b19f7823baea45e506a610c269fb2360ee2eef57a81f608c1629879cb5a9f548a3c3ad52e7e85b1227432affa57

    Download Submit

  • C:\Windows\SysWOW64\smnss.exe
    Filesize

    2.4MB

    MD5

    8e2caebfa6f0c777b8e25d9c22430569

    SHA1

    b1c74cc87b1d01a142323414bf4b827f309036be

    SHA256

    f53ea6929fa540584ea9e6a28d7929fdc758c8069a655703bcac9bd7a7cb2eb9

    SHA512

    c70d08a2c8afb7df07dea5a30c4a148297003a51fe6771e46ed900a9b96902f85a9e4c7338457202632a5ed2c06c9e7e4ce809c77a769d37397d1a0b6af2fa4a

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    6552b9f7b951dbb9d47489d27756f21d

    SHA1

    261836ef50ca1214b6c03f2d85196eb19d56bfca

    SHA256

    d2d885cd8485d19d72fd53b364725fed1ae472cb1269e0711bd8677c96bb99d1

    SHA512

    1ea7cbcc9425ee864093aacc46d7ef098377d59dab62f528118e4c44c3d70bc3601680f9d1a679dda9950da98972bce770eaa12dc88d9ce81ff2e01dc4cb4ae8

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    25a91e84f6b5393fd4a9a7bd5a59b466

    SHA1

    1093c071c3ca3911ab427eb7a06bc2d457c66373

    SHA256

    02590c87d2049d39bb7274a142b1bc047735417a5bed254447b09f04c1c2d384

    SHA512

    1b3216242db849a14a64c3aed050967bfcc674d1be9d418e927184e07fe76ede35dcb6ff9f6f04ee94df8e42270e3139dd449a5453a8777ea7c152c13253047e

    Download Submit

  • memory/2244-29-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2516-13-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2516-20-0x00000000003F0000-0x00000000003F9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2516-28-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2516-25-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2516-26-0x00000000003F0000-0x00000000003F9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2516-0-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2516-34-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2516-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2808-43-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2808-53-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-36-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-45-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-46-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2808-48-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2808-47-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-49-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-51-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-39-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

    Filesize

    3.8MB

    Download

  • memory/2808-55-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-57-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-59-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-61-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-63-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-65-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download

  • memory/2808-67-0x0000000000400000-0x0000000000DCC000-memory.dmp

    Filesize

    9.8MB

    Download