Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 14:22

General

  • Target

    27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe

  • Size

    18KB

  • MD5

    38c69afeef3326f419418332de4f77a0

  • SHA1

    224e853043042ab4b759f42e9452736bbdfc1d04

  • SHA256

    27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636

  • SHA512

    99ee072769ff68bf92c1aa93f09bd941c559f65ec355126ea21e01b96211f7ccb7e2611b68158ac7fa3e659dc712b4d560c25afbacebe1402e98c6ad525259df

  • SSDEEP

    384:r6eHIAx0pqNgHvRtoyhAkeKE7pDKbR6hcdBYpBmLE:r6eHIMgPRtzykeKE7pkRpTE

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe
    "C:\Users\Admin\AppData\Local\Temp\27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\OINKK.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:648
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2592
    • C:\Users\Admin\AppData\Roaming\trys.exe
      "C:\Users\Admin\AppData\Roaming\trys.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\OINKK.bat

    Filesize

    135B

    MD5

    6dbb2090ff90500da05a027765cde190

    SHA1

    425b833d9d1df8d6df6e5a59f738058808271949

    SHA256

    71ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881

    SHA512

    7e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3

  • C:\Users\Admin\AppData\Roaming\trys.exe

    Filesize

    18KB

    MD5

    136c6bd53755e797869e7b9a0edc429c

    SHA1

    1c7c04c4b57039156cb2f154c856fb9cd920cfc0

    SHA256

    2da68efb09d12175c6175836ec8a7639b189b946977e4f8882a2e14080803468

    SHA512

    f6c1eef7cf617c0010dc46f0a4274479e87d1ff0b35fdb0d6760d90cda5f77886053579ad5483e696529639e601d00921410eab47db2b612fd3acb12a1a5c37c

  • memory/2720-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2720-40-0x0000000001D90000-0x0000000001D9E000-memory.dmp

    Filesize

    56KB

  • memory/2720-39-0x0000000001D90000-0x0000000001D9E000-memory.dmp

    Filesize

    56KB

  • memory/2720-45-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2720-46-0x0000000001D90000-0x0000000001D9E000-memory.dmp

    Filesize

    56KB

  • memory/2744-42-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2744-48-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB