Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2024, 03:23

General

  • Target

    klvideoconverter100.exe

  • Size

    15.6MB

  • MD5

    699e8703f89320ba3577acc3c9b94cc1

  • SHA1

    c25ee304214f2602d7a493c062357e84bbb1d21b

  • SHA256

    e38f3081e1752ea792920d74839f3b5b97387ad78616fe8c354fc78cb46901b1

  • SHA512

    cee15d4e490be17ef67ad7d6cbaa2243ffc9d7152a7abec9c5124941dc5d16294a277e0dbaea10d128a5bcebe3cbdfab9d6dcb0da6cea28f926c26921f6e29d9

  • SSDEEP

    393216:cdbB112aIPXBBygsqruRh6elGNBg2QUNAWj:E312h/vyHb5OuUNRj

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\klvideoconverter100.exe
    "C:\Users\Admin\AppData\Local\Temp\klvideoconverter100.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Users\Admin\AppData\Local\Temp\is-ILKAT.tmp\is-KSSOV.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-ILKAT.tmp\is-KSSOV.tmp" /SL4 $400DC "C:\Users\Admin\AppData\Local\Temp\klvideoconverter100.exe" 16097290 52736
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-95AOI.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-ILKAT.tmp\is-KSSOV.tmp

    Filesize

    659KB

    MD5

    33f7ff58846f9d1c124e3b9f2f464c75

    SHA1

    edc52a13bf6f05edea30fac93afd46d6107d3d56

    SHA256

    d7a755b41a765b5e682ba9130b5d94857745de87787b0e87d012bc19a06f67ab

    SHA512

    b866964326a7063f2e0683d3a61ebfc13bb0b37c3d22afe4b627a2a16a860232ed34ddb7a6c61abdaffd39e39d4d4de0bbe3b7aabe0ccc615fbcaf474b1c4977

  • memory/2156-12-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

  • memory/2156-18-0x0000000000400000-0x00000000004B4000-memory.dmp

    Filesize

    720KB

  • memory/2936-2-0x0000000000401000-0x000000000040A000-memory.dmp

    Filesize

    36KB

  • memory/2936-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2936-17-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB