Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 02:22

General

  • Target

    dd70e929cd0d2bb0b1188f260eb3c3dc971fb94504519c90a78b6e3900eee048.exe

  • Size

    468KB

  • MD5

    bc05592abc4705627f564ca6b65e5ea6

  • SHA1

    c37090f1fb189380681c1d9fa7caae99f92e3782

  • SHA256

    dd70e929cd0d2bb0b1188f260eb3c3dc971fb94504519c90a78b6e3900eee048

  • SHA512

    059dbe83e90afb9a630610afeecd2e307233ec252142fa2bcccad90ef3270db15c1fcdc1d6a730b0fc29789d0aaac51652e4643ca41b98ecd524dda3812faeed

  • SSDEEP

    3072:MTANoSKVI95UtbY2PzPjcf8/PrMDPgpwVmHeTfsampN8XrWukclg:MTqow7UtlP7jcfPcQ3mpi7Wuk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 39 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd70e929cd0d2bb0b1188f260eb3c3dc971fb94504519c90a78b6e3900eee048.exe
    "C:\Users\Admin\AppData\Local\Temp\dd70e929cd0d2bb0b1188f260eb3c3dc971fb94504519c90a78b6e3900eee048.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25929.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1908
      • C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exe
          C:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2904
          • C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
            C:\Users\Admin\AppData\Local\Temp\Unicorn-55833.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2812
            • C:\Users\Admin\AppData\Local\Temp\Unicorn-60701.exe
              C:\Users\Admin\AppData\Local\Temp\Unicorn-60701.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1948
              • C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
                C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2640
                • C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe
                  C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2492
                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exe
                    C:\Users\Admin\AppData\Local\Temp\Unicorn-5660.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1764
                    • C:\Users\Admin\AppData\Local\Temp\Unicorn-31006.exe
                      C:\Users\Admin\AppData\Local\Temp\Unicorn-31006.exe
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:2924
                      • C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
                        C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2960
                        • C:\Users\Admin\AppData\Local\Temp\Unicorn-50892.exe
                          C:\Users\Admin\AppData\Local\Temp\Unicorn-50892.exe
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:840
                          • C:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exe
                            C:\Users\Admin\AppData\Local\Temp\Unicorn-11712.exe
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:2980
                            • C:\Users\Admin\AppData\Local\Temp\Unicorn-43163.exe
                              C:\Users\Admin\AppData\Local\Temp\Unicorn-43163.exe
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:2096
                              • C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe
                                C:\Users\Admin\AppData\Local\Temp\Unicorn-37782.exe
                                15⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:2148
                                • C:\Users\Admin\AppData\Local\Temp\Unicorn-37533.exe
                                  C:\Users\Admin\AppData\Local\Temp\Unicorn-37533.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1656
                                  • C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
                                    C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2600
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 244
                                      18⤵
                                      • Loads dropped DLL
                                      • Program crash
                                      PID:992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 236
      2⤵
      • Program crash
      PID:836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Unicorn-31006.exe

    Filesize

    468KB

    MD5

    5702b2343dc7676038d274bfd231245f

    SHA1

    2ee1e11aed8e92d06faaa56b494b751402f81692

    SHA256

    614c7993ba2540514855dc2a06edeaf65347f54bd0f75f186acc344a529ad4f9

    SHA512

    829a26994ecea01f0e5234277cb2b9c731bca6d9b67ab4bdeb1840419ddeb78960f4f089442deab16072ab07370393e3d4bb7ba2f8fa200310dccd3ed256d68e

  • C:\Users\Admin\AppData\Local\Temp\Unicorn-37533.exe

    Filesize

    468KB

    MD5

    00f057ce3db9eb53c0fab079b9b634a3

    SHA1

    d41c5f54c9419df17208d115d32804b4f72afd69

    SHA256

    5ac6be04532620230d035c1f9c4a333129a3d7bc7fc5acc5a0b5768d5052b675

    SHA512

    3553cd827c85997cce1b45be6764a42220403a488c2961c4f5c96e9037bf219512cfb3cb5a1aa64e3bd6de22fc37032650e9f136d49acb4d5693f1726d9b27cf

  • C:\Users\Admin\AppData\Local\Temp\Unicorn-43163.exe

    Filesize

    468KB

    MD5

    3c5a520f3c4b1e2b287292d4389c204c

    SHA1

    b22f44c9071456bf9a071cfdfea26578d8e2e165

    SHA256

    76ce99e48948702cd64f4477117ad3b666190c3492ae5eab4d14698a25334b4f

    SHA512

    d26c4c7c2a239dbd8bd5bc8d6931dacab6d2ff203c77f8c15a9f8af585126b550b1981a7d65135dd2af7e5efa17f64122682799a6d1ddcf1654b4a4e09cc3f6f

  • C:\Users\Admin\AppData\Local\Temp\Unicorn-60701.exe

    Filesize

    468KB

    MD5

    4023855eddece496e704c679fe035de9

    SHA1

    90df1357601d4797bfdd2ad30f60f1d38d89dd4f

    SHA256

    ca04233c9066a5db0483d23a8c0c4706d9a85a812853484b54f7a85a2601a95d

    SHA512

    e24d6b3b539648d5d19bbf6ca735213b880035cae96f43728138dbef8ddfe7080c00e0ca6dce8c06e5662b671c7bb1a9171413661a72897afd02bbab07c13e7b

  • \Users\Admin\AppData\Local\Temp\Unicorn-11289.exe

    Filesize

    468KB

    MD5

    cd2d4a5cb8477d1ee57b9679aaf5c556

    SHA1

    043002f0b2732609c49639861e53a0ac8f11cafb

    SHA256

    7bdad305bba22259cea9b962775b821b709da70abc037cd288b09bcb4c44135b

    SHA512

    689fabb64860dd26c780d43068f07c7d4d12aa096b5489446edcffbf93a7db19ef3f1e9193590116d7969c8ec3512f9168b7f24330447e735c5a8591de8e1294

  • \Users\Admin\AppData\Local\Temp\Unicorn-11712.exe

    Filesize

    468KB

    MD5

    25a8d1f1569ab9c4990a38ec5d338d6f

    SHA1

    6f8173c097cff904592681cdbacd35fe9210987a

    SHA256

    91c046e04a2dcebccef21eee4496db0b7534d47f1fcbb1955290279e79e6e967

    SHA512

    74c7b4ee934701c5b9554da0e4c643d781ac736ad84b79e30ff1cbfec61b994cc9680d3a80f6b4ee454ecaa0c3b04387cc70f892ca4b15b1861c5e258d821a81

  • \Users\Admin\AppData\Local\Temp\Unicorn-25929.exe

    Filesize

    468KB

    MD5

    b39c97f11677bee569c5b88c6cecb90c

    SHA1

    ca077af19fd02b0e8bf2a5fa5c3b9b1ae9cd1cb1

    SHA256

    bd8e5cea5775b4a4d041149eff5f806dfded201ee72ed95c58420dd9788a20cc

    SHA512

    cf51c2f9a2ed9eb78b44dcfbde8643a91eda869a4fbb5faf7540e96b62fd0e09db0988bfecb852a44d9ef86379853832e6630e9dccad938b3ff4eb609dde281a

  • \Users\Admin\AppData\Local\Temp\Unicorn-29080.exe

    Filesize

    468KB

    MD5

    4e12e74e040ea662367329e0e465aa39

    SHA1

    5e517aa5523c1f0f674b7f7824c97f7d8830cc4a

    SHA256

    13b34938cbe1a6eacff57ca0b87b458ca73834a21093034dbf1814e9428d8c10

    SHA512

    e557ae6849f30c6f8c0225b2dc282bc4175ff4b27be197b6b05df9ad612904e5b9b473f7456319a2504d4be59bf888ec86ace9cef3836d457814271d7fe2066f

  • \Users\Admin\AppData\Local\Temp\Unicorn-37782.exe

    Filesize

    468KB

    MD5

    914fcc96fa899eb9c6900de0e6d3b229

    SHA1

    fdd06753052d500e7a8ba993d8e1e5de68c5dc72

    SHA256

    3dfae8491ec16ff7d2f0168e02bf600eec2cf47d8852f1014b6863eb9811ab40

    SHA512

    3f9baacc6e3f73a1df9acd01c69bbf0424bd8a35c29ed9ed8b8391dc83bc732f0a3bed90019b2498a3b669f5e3a35140db6126fe452c3222309596a3c6645176

  • \Users\Admin\AppData\Local\Temp\Unicorn-43047.exe

    Filesize

    468KB

    MD5

    a027ad7d92a2aa472054b7fc7d2c43cc

    SHA1

    4d2dd84eb9026287f4a3d54e8adc69a5883aaeec

    SHA256

    1b40255ae9dd9e9c1829b2880bd08121b817b42072b1fcf3cbe9a7da90e148e6

    SHA512

    df7dd11ab0e4abfffbbc6b81d7e60ad90ed7cb8aef05d3dc1138d8a14e2327386790d07198b643239745bb7e986a219aab2f856db6c8b1db213f7b598b4ec9a8

  • \Users\Admin\AppData\Local\Temp\Unicorn-47915.exe

    Filesize

    468KB

    MD5

    1fa56e386ef535ba595d0c65340d13de

    SHA1

    a41268fadeec0529067c1de91dc1a33f3f71ecf1

    SHA256

    68efbe42f691d9ab23474bb92bd36251922b155d60089294d885d17c1f6c58a2

    SHA512

    c7f7a2e9ba3b60d1b123c3c71d86f9f3279342a30c2e248138db30f3bfefa69e8611fcbd3050a1b7bbb2b03527375f487801741ea22ebb633c7228ebb51f0109

  • \Users\Admin\AppData\Local\Temp\Unicorn-50892.exe

    Filesize

    468KB

    MD5

    01e2f348460f2ced250d835764459f53

    SHA1

    feeb529912a7bd2f97832e5a1a94120aec17d079

    SHA256

    3886729d999505a199883d855c5ba39a2ffd327f2a4d4b87f2ac19f97a28e8a4

    SHA512

    c3fd2defe222f62dc9fd575f33e585abdc66e88dc801c9ffb07f87d9982458ab3b69ad8581ad4c01cd7580565ff2bcb8a8f677a0538507cda38f60389c287af0

  • \Users\Admin\AppData\Local\Temp\Unicorn-55833.exe

    Filesize

    468KB

    MD5

    672b108acaa94b085c58970e221ee583

    SHA1

    48675fd0d58d62a2b574dd9d5cc4b49e386a6e61

    SHA256

    34f5ed531009c57d3cf21915f014912c00e49b0ce15f26ef7a41b7781127b102

    SHA512

    4321f65e710497ef9708ddae9c32f44eced2d268f13c7efc0c18137d3c22b97460594c25957553235c4157066889a49e6cd7f4fe6c92cf53357ba0423e3235d7

  • \Users\Admin\AppData\Local\Temp\Unicorn-5660.exe

    Filesize

    468KB

    MD5

    779d2220c21fcebcfea3105f01859c5c

    SHA1

    71c09875648f39d139a598a02d673bff1d64e586

    SHA256

    17bb0b40f0072559ae7dcec718546aa207c980efd18c5214b3d5b5b2611a5347

    SHA512

    c043e20d280531973a8f5e4ab30943b09f68edc495a66a2e517bb6594e5802a46bbcd313a199d06d32ee0e4f3cbfd0435add50aa0ab84dfb9b8a3932a0ab76c1

  • \Users\Admin\AppData\Local\Temp\Unicorn-65319.exe

    Filesize

    468KB

    MD5

    28c1a45cc4ba202a99420463298aba64

    SHA1

    df1b44391dec8485a9fc8dd2e8022cdd778f2e0b

    SHA256

    5fce559176aece1f2c44398f4e83575302a8dd8961b8828112ebfd213228e78f

    SHA512

    dccc1c5502584242e055a4881f0b8dd656bffdbb8b9c3cd1c5d25c7f504264779ba7505945ebe6ab0c28dfa5405f66ec5be44b5feb46c8d1f7328bb6a7fbafab

  • \Users\Admin\AppData\Local\Temp\Unicorn-65531.exe

    Filesize

    468KB

    MD5

    c4fe0fdf2e9b6eac0dcb7f9067910a73

    SHA1

    aefb832f62deef93291da0cbf0ead77d57849a07

    SHA256

    5759d63c813068c11a40015374e2be93437fd4324b3367a38dfe8ff429e1b04c

    SHA512

    c07deee26958b2ddb35a6546345976e7a7e0f129dbd9ff6b2a57132e0b7ad5efd9d4f28708e9e052d2ad7aeb8ff6995cfb374fecd7091941b723797838b7316e