Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/09/2024, 04:33

General

  • Target

    f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe

  • Size

    91KB

  • MD5

    99583bad9b5a5a950f175e054b42d4b3

  • SHA1

    0179a7e86748547d6460ec0c4b1c5e094fe7d03b

  • SHA256

    f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839

  • SHA512

    5394a66293cc54ee93315d09c1d7ba6b5c948a47ddd958ef773dbee25e05d3c2d35d9d41de8fa5274b0ed155bf5c1b2b48aacd72b1e966e87ca6fb694848b624

  • SSDEEP

    1536:XJRtlEnBHHIgabuYotV/JbJCX5SBixJRtlEnBHHIgabuYotV/JbJCX5SBiE:XvtYxOuYotvYQIxvtYxOuYotvYQIE

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Disables RegEdit via registry modification 2 IoCs
  • Disables use of System Restore points 1 TTPs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 22 IoCs
  • Modifies system executable filetype association 2 TTPs 13 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Drops desktop.ini file(s) 4 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 20 IoCs
  • UPX packed file 36 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe
    "C:\Users\Admin\AppData\Local\Temp\f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2112
    • C:\Windows\xk.exe
      C:\Windows\xk.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2124
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2548
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1940
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2644
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1828
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:884
    • C:\Windows\xk.exe
      C:\Windows\xk.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2340
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1876
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1344
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2440
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1236
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2212
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1520
  • C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

    Filesize

    240KB

    MD5

    c0e8b4334b8ec3d5a0d21ecf9f711cae

    SHA1

    3d159f320df89f68baabe80ad3edc2346f0e35fe

    SHA256

    6e6abfb8ed0bd4fc3102a0eec91219f051e8630b015801f3b4c4d720abbd5bee

    SHA512

    d57cb3597878e7a546759fff78e92792fb2b46ee4b220db4d11fd9e12a452d19728c29a130a535330bab56ae6f57d0256594fce8f799778e52b40d08680e1679

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

    Filesize

    235KB

    MD5

    491765652386343328bcd4e0a30ebc2b

    SHA1

    9dbd72d4e4d61f408e8fcf0fa6b2db08198fd8ee

    SHA256

    e719c0e9ced9e1e75045f439a8611ca48af90a7b7c03f2d8a6e75e96f47814d5

    SHA512

    551746099f66b963be7367aa8193685860ea11b4a96fc27d6d9e2a04279213de22d4dd7c5231dcf7a92ab80ceb807d1d98a4d6ba36a51089fdcfb99cbf6c4936

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

    Filesize

    235KB

    MD5

    1d2fe883a23da7d9fae279c3386332dc

    SHA1

    deb17b7ff97d5a40e44005c79507e21c21ce48e7

    SHA256

    c70066ea39641d99e326978b5994ab37bd9b4f146c1460070e76e9708fc0edef

    SHA512

    0fcb88ea04ad8b84384717bdcaedf5094ba47eb81a00deb683ed6775fbfb7e27b5ea7a834954ccad9fa8d17b1a1619a07cbee020e2eebe1021659519c4706843

  • C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

    Filesize

    1KB

    MD5

    48dd6cae43ce26b992c35799fcd76898

    SHA1

    8e600544df0250da7d634599ce6ee50da11c0355

    SHA256

    7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

    SHA512

    c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

  • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

    Filesize

    91KB

    MD5

    02e6e25b3671159d5692f5f3ae7a6eb2

    SHA1

    615cdca62b009f4f80f3b23123ac32df270eb677

    SHA256

    9a7f5a97322a91b93b4312a5b7667b3d92ee95521aabb55ff60ef97c08876c35

    SHA512

    3b98f4a4ce04ba18b54cc1a51cb16b44fa639fa5839da063c7db826e35738a4f28b0ce02cf8a8535dde85cae802e5d1244f99d6cbb2bbf0521264926b9121579

  • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

    Filesize

    91KB

    MD5

    c1c1f1af4b2f7910d32c1f38d347004c

    SHA1

    d99003f741bc0a38db3a18f6c9e01b9704f76fb3

    SHA256

    99b933488a9a0e5db0dc1fa78676f3704046e2be1b3285b3e4baca3b2c5dfecb

    SHA512

    b8a085619f12955f207c33da2374a92173dceb7094b57f000502c6cf727e5ef26ba4a70a8f3a8c2774cb88d81c209a832ddb57a6246022baa3a2ff1719fb2c31

  • C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

    Filesize

    91KB

    MD5

    a437baea036c7bebaef2fd073f3fc670

    SHA1

    c87a92de97feca218a99e586f081d412dc65b38f

    SHA256

    aa1be722ff5198a64ee72da192d182a8728aba3d1f415c518af5c9eefe7c287b

    SHA512

    2a978a8c1432cd0284778aebc32ce094329e811d3183ec01e1f0efa87a25eb6ed492fe8ae1606e5dad14a791f0b3f7ea518ff319fc076ccae2bab406ae906d48

  • C:\Users\Admin\AppData\Local\winlogon.exe

    Filesize

    91KB

    MD5

    99583bad9b5a5a950f175e054b42d4b3

    SHA1

    0179a7e86748547d6460ec0c4b1c5e094fe7d03b

    SHA256

    f735bc5eab79e5dc0b6e78184ab5f62d2710ea5a4664d82bc7c11a8e2a2b5839

    SHA512

    5394a66293cc54ee93315d09c1d7ba6b5c948a47ddd958ef773dbee25e05d3c2d35d9d41de8fa5274b0ed155bf5c1b2b48aacd72b1e966e87ca6fb694848b624

  • C:\Windows\SysWOW64\IExplorer.exe

    Filesize

    91KB

    MD5

    60a7873a9d653e7ff243fd397f5ac88e

    SHA1

    22e5c1c3dc70efa4f6c1771b0a65306d754630a0

    SHA256

    dfce4ac760eb42bdc1714216b34982ad46f59ec33d01954fbe2bdad71a1f274d

    SHA512

    8d4ba42c4e8ded63856c35513f42c4e30ab4a760e8c18cfdd5d381b35e22f76af8ab332ee132889ca42f139e734bb79fa150efef5639dee927b89c65d7291d41

  • C:\Windows\xk.exe

    Filesize

    91KB

    MD5

    fa1bca73f422535e76d6a6e828adaa7d

    SHA1

    7a24ff67c2feadccb74c6bb3adfbe9f97ba3b733

    SHA256

    1ebc139315332404a283ae46950b0276de0b767832b7b455438d9d8cae483c29

    SHA512

    cf147197419761b23d671d99706b5f6f5070054cc27e321a6b759b0399fb13cd74cef9393c022308732451ed5d18090970dfb4a0a9962812cdbbad8ccc3ca26e

  • C:\Windows\xk.exe

    Filesize

    91KB

    MD5

    bd4a71d43b4afeb21df26a3bdca2e277

    SHA1

    501c54eef73e469a84b20652e54fec64c0272583

    SHA256

    68400676a74525437789b6cad888664a1124bb98526778547b710d47b05b6759

    SHA512

    802a8ac2986dcd93c2ec2c5a8afe95100d63e9f2b9e618e6a93a176c7d2ca76d856dea51d118f2bbd8428c928de46719c81174b45af10212e8eb072218532236

  • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

    Filesize

    91KB

    MD5

    c5eebd0c9601a36206ea9d72270cd1f8

    SHA1

    6b60a01c30548992fd84389c808078eeb71244bb

    SHA256

    12e87690dcee7abe99b3a56b0398c53ce13d135c62670e65ba83b6b1df595043

    SHA512

    1ad37a307db0b73a38107c58cb5b702bde6b4ed2e1e4366d1662743d95609c430cf1ab01d986f23c809c3e1632fd819bcec3de275ed0f468c8bcef328e1c83db

  • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

    Filesize

    91KB

    MD5

    5bc212ecd07c5e5b7795509fe61c3e9b

    SHA1

    e31e03028bc9de0f4daa7e201159057ede300c5f

    SHA256

    e6a3497a2921cbbffdc543cc5dca0ef70679fac85da5e65722aab563b09ba2ae

    SHA512

    f4b3376b8cc8edfe1db76c31a78f10cea1ffc1e3947a494a7c4d678182eeacf70dee25bdde932dcd6f685bc1bb77d90a71f1e7efed6bdcc8055c2a14dd7de69f

  • \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

    Filesize

    91KB

    MD5

    73b511b29d821e66a58abcb2d444a51d

    SHA1

    1e3f1126187ab0b39cbc3d2f80cad8d979469072

    SHA256

    dbe80f2bc785d9ddbc112f2ab404eb382340183b62f448ae996afe7c9d8b45eb

    SHA512

    87f6c7d90c1cbf8f9916a3ce902f4b9e639251ea6fc89b637903e2fbadd2829a8cadb28767c1ea76afe177ed8bfe9ac86a1ff93231f4c992789d96ffc458f524

  • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

    Filesize

    91KB

    MD5

    518960c8487e3ff6621b1dbca1344fe7

    SHA1

    436e283360d1ab2c5babf1e9f50ee318a48a0b08

    SHA256

    9814be84fdff4043230d34687020da4e77865a8cc48cf83c2d3bba2c53acd5e9

    SHA512

    a56f06c64501b21326400fedba54e67a8778bfb2794ec2544e045d54076b7d90721cbc52a439b55fdea7bbd23ee20641b1ae1a8c58d325d4f30246582fd0af8c

  • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

    Filesize

    91KB

    MD5

    77273a017934b0ae624961d7ccb15dda

    SHA1

    aa6cc9c041d1ec64b81db89dac32289c018c8796

    SHA256

    e9914aafb0acdcd104bc414000d849385605d09af2e38ff4126868aa31dc00f8

    SHA512

    e91c96bbf6bb26bf1f2b73e8ca93dafe5c4ee8ba66e33cb92b20edfab8c8a4f67d798176080626c4a780887a1664fcab0822dd9bf1673c055f2ad47b5a631a29

  • \Windows\SysWOW64\IExplorer.exe

    Filesize

    91KB

    MD5

    4ebf6dd5fe18f9bf43c2b831e8272306

    SHA1

    b335301b970b8b306f91248c6156f1834d31f90e

    SHA256

    cfcea0a36a8ff1618f329283d58ee87fdc4a789fe021a078e1606efced3f5d3a

    SHA512

    1e16adadec15f6f336dc2d66e7ba02449286b8cfd54871d7422444f8ca827b4354f4be68cca336d57155a82381f916c64d3637a02e0a1316b60a6bf73b13d953

  • memory/884-173-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/884-176-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1236-297-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1344-259-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1520-310-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1568-335-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1828-159-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1828-163-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1876-254-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1876-243-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/1940-139-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2112-280-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-281-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-172-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-157-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-268-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-267-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-465-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-440-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-464-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-140-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2112-255-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-230-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-437-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2112-394-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-466-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2112-295-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-122-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-106-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-110-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2112-392-0x0000000002680000-0x00000000026AF000-memory.dmp

    Filesize

    188KB

  • memory/2124-114-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2212-299-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2212-296-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2340-242-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2440-275-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2440-269-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2548-126-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2644-150-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/2644-148-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB