Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 12:59

General

  • Target

    a6dc10c08ecaf40db65fdcdfc4839f487257f3bf9db44cfca62d9fa76f49f611N.exe

  • Size

    78KB

  • MD5

    864d51ebd98fba435ff1c57c5696c760

  • SHA1

    9420d56ef6166d7ab5306904e580d31d68d6aee0

  • SHA256

    a6dc10c08ecaf40db65fdcdfc4839f487257f3bf9db44cfca62d9fa76f49f611

  • SHA512

    3e8afbacf784128e168e3929f4f4a937276dd3e7098f46e2c44ff73b1232ef8b65ed0567285f65fb64b297549f9247deaf5234b3df0f4fbb9ea522f3294ebe72

  • SSDEEP

    1536:bmCHHuaJtZAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9QtLa9/J1zk:KCH/3ZAtWDDILJLovbicqOq3o+nLa9/c

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6dc10c08ecaf40db65fdcdfc4839f487257f3bf9db44cfca62d9fa76f49f611N.exe
    "C:\Users\Admin\AppData\Local\Temp\a6dc10c08ecaf40db65fdcdfc4839f487257f3bf9db44cfca62d9fa76f49f611N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\guw-ka-b.cmdline"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9619.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9618.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1696
    • C:\Users\Admin\AppData\Local\Temp\tmp950F.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp950F.tmp.exe" C:\Users\Admin\AppData\Local\Temp\a6dc10c08ecaf40db65fdcdfc4839f487257f3bf9db44cfca62d9fa76f49f611N.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RES9619.tmp

    Filesize

    1KB

    MD5

    d855964020eb973535f3895aee9fc6bf

    SHA1

    585c1d1005ea5cbfa1889f9fff4ba839a3509121

    SHA256

    696ec40c7515217e3ba6bdf1d790416624df576ce755c0d9fa1346f3638b4298

    SHA512

    2ab212badea32b29719e70540b95a12c253672680e5c329bb86058715d7d73eee3aa7b8ce670ebf3303b85632b8710a2931710d00865de1138c6be53251051b2

  • C:\Users\Admin\AppData\Local\Temp\guw-ka-b.0.vb

    Filesize

    15KB

    MD5

    cba3f77ab449e6b693d81d1a9737c927

    SHA1

    36534d2876329b03244828be38527f5f99bf623d

    SHA256

    82902d9a3084dc33586d124fcb6f902739c5db7e4f6f295df9f90d423483fb58

    SHA512

    96663e186df9d99d3f0595dd4d0f9bb801e7f7ddaeaad8ffc3b418b6f27b209f44ebeed10c9ec884394cc99ef35e043bd1d9a4f4cb3f17a7ba963f1ef96cc77f

  • C:\Users\Admin\AppData\Local\Temp\guw-ka-b.cmdline

    Filesize

    266B

    MD5

    ecc8fb6f6654345549dadd518f4eb3c6

    SHA1

    b8da19245ff194f6e007dcf304d0c247f007086d

    SHA256

    d2586e9ffea00346cc92227eaecae62a3e6eb151e5fd63a08ff47598f87cdc87

    SHA512

    3fa0c76359da3570e48ac33b93d01705eeb87681fb79cf95011c94678b133f9ef36cf0f78a4f84a4c559fd4f19b6e64b51e4f7247bc978f605f3eeff2cf262de

  • C:\Users\Admin\AppData\Local\Temp\tmp950F.tmp.exe

    Filesize

    78KB

    MD5

    b799331cfa209305d39983e0e5ce4618

    SHA1

    2c6f46f2e7dbe9f9db3d9d67cf86cbddfdc68d51

    SHA256

    3312641bb3b619958312f5ff841bd59e7efab4319344c4722ee952a3cec351f4

    SHA512

    473a2a43d2e449902a7b463dd262a4b2f0543cea21aab60cb47bd7415d119c316f8e75ce8576abc1d160bc2f42093acc923b4b6d2f72f89ddc5e39806401a319

  • C:\Users\Admin\AppData\Local\Temp\vbc9618.tmp

    Filesize

    660B

    MD5

    d492c2c6d76ca0c6bdc507b4a5674649

    SHA1

    a23d56c838c52e0a2b2174dd87e4301ccdb59c03

    SHA256

    7c5b931dcfdca1bff35f11ed78dd60003c9907f4ce9b8fefbb0a5a4dfe85491b

    SHA512

    2bed33b033ca0a8f7d76d29eb6df37e28979f40787e440aaa55ea11d0cf09718eb171a1d307f62961cf80b4585d550f75d946b74a47448020f81289faeabe34f

  • C:\Users\Admin\AppData\Local\Temp\zCom.resources

    Filesize

    62KB

    MD5

    a26b0f78faa3881bb6307a944b096e91

    SHA1

    42b01830723bf07d14f3086fa83c4f74f5649368

    SHA256

    b43ecda931e7af03f0768c905ed9fa82c03e41e566b1dff9960afc6b91ae5ab5

    SHA512

    a0e9c2814fca6bcf87e779592c005d7a8eef058a61f5a5443f7cf8d97e2316d0cde91ed51270bbcc23ccf68c7fc4a321a5a95a4eed75cb8d8a45cb3aa725fb9c

  • memory/1288-0-0x00000000740B1000-0x00000000740B2000-memory.dmp

    Filesize

    4KB

  • memory/1288-1-0x00000000740B0000-0x000000007465B000-memory.dmp

    Filesize

    5.7MB

  • memory/1288-2-0x00000000740B0000-0x000000007465B000-memory.dmp

    Filesize

    5.7MB

  • memory/1288-23-0x00000000740B0000-0x000000007465B000-memory.dmp

    Filesize

    5.7MB

  • memory/2136-8-0x00000000740B0000-0x000000007465B000-memory.dmp

    Filesize

    5.7MB

  • memory/2136-18-0x00000000740B0000-0x000000007465B000-memory.dmp

    Filesize

    5.7MB