Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe
Resource
win10v2004-20240802-en
General
-
Target
f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe
-
Size
1.8MB
-
MD5
2f91a52ce172b10c730387788b06358d
-
SHA1
e22f66c120f19156cd143b35b565ad5956ae6013
-
SHA256
f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2
-
SHA512
0bd96b3af646bbec0429a6747b96fa6e28f66477b0a7c40af4a7f2ecdc7ccac5681ca3300cb10d7e66cb62a3a3fd88b963660388a262868b38f30acace5e2eca
-
SSDEEP
24576:04nXubIQGyxbPV0db26WoJVEuvsv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdO:0qe3f6S9SffPMWrQ0Zk
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 1392 7za.exe 848 bin.exe -
Loads dropped DLL 4 IoCs
pid Process 2264 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bin.exe -
Kills process with taskkill 1 IoCs
pid Process 3020 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 572 schtasks.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 848 bin.exe 848 bin.exe 848 bin.exe 848 bin.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 848 bin.exe 848 bin.exe 848 bin.exe 848 bin.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2376 2264 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe 30 PID 2264 wrote to memory of 2376 2264 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe 30 PID 2264 wrote to memory of 2376 2264 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe 30 PID 2264 wrote to memory of 2376 2264 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe 30 PID 2264 wrote to memory of 2376 2264 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe 30 PID 2264 wrote to memory of 2376 2264 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe 30 PID 2264 wrote to memory of 2376 2264 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe 30 PID 2376 wrote to memory of 3020 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 31 PID 2376 wrote to memory of 3020 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 31 PID 2376 wrote to memory of 3020 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 31 PID 2376 wrote to memory of 3020 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 31 PID 2376 wrote to memory of 572 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 35 PID 2376 wrote to memory of 572 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 35 PID 2376 wrote to memory of 572 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 35 PID 2376 wrote to memory of 572 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 35 PID 2376 wrote to memory of 1392 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 37 PID 2376 wrote to memory of 1392 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 37 PID 2376 wrote to memory of 1392 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 37 PID 2376 wrote to memory of 1392 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 37 PID 2376 wrote to memory of 848 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 39 PID 2376 wrote to memory of 848 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 39 PID 2376 wrote to memory of 848 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 39 PID 2376 wrote to memory of 848 2376 f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe"C:\Users\Admin\AppData\Local\Temp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\is-1QECD.tmp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp"C:\Users\Admin\AppData\Local\Temp\is-1QECD.tmp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp" /SL5="$400F8,1074986,831488,C:\Users\Admin\AppData\Local\Temp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\taskkill.exe"taskkill" https://setstat.ru/api/savePostback?chid=%s&guid=%s&type=vkdjbin.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3020
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN principal-plus /SC ONLOGON /TR "C:\ProgramData\ports-postal\bin.exe /H" /F /DELAY 0001:00 /RL HIGHEST3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:572
-
-
C:\Users\Admin\AppData\Local\Temp\is-6TU5C.tmp\7za.exe"C:\Users\Admin\AppData\Local\Temp\is-6TU5C.tmp\7za.exe" e "C:\Users\Admin\AppData\Local\Temp\is-6TU5C.tmp\5.14.zip" -pvkd -y -oC:\ProgramData\ports-postal3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1392
-
-
C:\ProgramData\ports-postal\bin.exe"C:\ProgramData\ports-postal\bin.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:848
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.7MB
MD52e9b855fd40c1730ead9dbe3942a8d53
SHA1406de9e251c4d61dbb89bcbb0f6d36c1f61ebcb8
SHA2567e15514285906a7092ba879dcc4db88e2f9e1356846ca983fa33d05d8b28ecb3
SHA512dd706ea30041c4bade58d8df49126c63967deed204bf76edc9e9bebd1c9736447965d5c935df9c687eed9f9fbd60fdb61349d939b78576d4d918a34036054e8f
-
Filesize
717B
MD5822467b728b7a66b081c91795373789a
SHA1d8f2f02e1eef62485a9feffd59ce837511749865
SHA256af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6
-
Filesize
504B
MD59be9036404a0746236e1093079c424d6
SHA15e25f29fa44b5abf8b7868d5422f624ef3aa2e59
SHA256b36ffa5740f4949b4b6f04990285774837c12faa5a7f8fade4f8733de9805ce4
SHA5126a6ab23e3e3e16dd76a2c35cb31543dad46ac8d6427b83ab443f66feda9f794b3ca0dcf2233f10e6018c7c78cd1c7116e5289d6d31a0a05ee92da32435d0b7c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD5828bf3e77ac772c62540e7ef8a15a689
SHA118d79f2d6c94f19dcfdac041d1b79457d8f61ed8
SHA256a8cb9a6d81daad551d92b4287b4e71f7ce5e9e9c8fcb4296dda5f9242f239943
SHA51279e14f70fcdb9a7046dccdc7ed1816edd30793514cdc728e697cab8007f762b2c8f3eac00009d50e20b99b741f42ef14cdf0ad64081b4a3df08970a13eb14a50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24E728EA67A1638D93C3A7ACDB892D04
Filesize550B
MD5c7317a0dd3827e85ec20094bcf079b2c
SHA1aa585ad26a7b34ec5bcc47fda71875e8c79847da
SHA256a86560f3562639fa2542ac3cf9c9716ed8bdf0559314635afea6cd17351cbae8
SHA5121888ce48d668a34b60c3b4a3d9bcdbb9bef36821373f5eb9943d062d004bee6a1ebff9f2401517a98b57ae933c051520ff563bc3ed24f48f1c60b4878b6b0434
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f40fde7885f14cb741f31a7a01a038ec
SHA1f391a1b4ba8bc2a4c01aa73b8ed818e0476a9316
SHA2562c055298e5ec6fb998423b59c693451c8a07c4bd2e89899511ec81e8c9baa4ff
SHA5124946e407be0d837a58d2d727224ef8a592f1f5e4174645e97ca2225866b848558cd90c182b765651a7ed3e5bb66b7828313f4b2f550125263586e5f8eec11035
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8B420DKQ\downloader[1]
Filesize203KB
MD5b9314504e592d42cb36534415a62b3af
SHA1059d2776f68bcc4d074619a3614a163d37df8b62
SHA256c60c3a7d20b575fdeeb723e12a11c2602e73329dc413fc6d88f72e6f87e38b49
SHA512e50adb690e2f6767001031e83f40cc067c9351d466051e45a40a9e7ff49049e35609f1e70dd7bb4a4721a112479f79090decca6896deac2680e7d107e3355dae
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
3.6MB
MD522f982f6129b7e8ddc2212041530e609
SHA1bef494910b3f0e48741ae8ab7af537d15296d096
SHA256c8519331e74fb0b204c7be4033d8bf448bd6bd15f16ad420debb5e4bd4076717
SHA51228394a4d4d6c53511e07a0ce0c0fc9ffe02e0de8e5aad588b46f37c4b7d5036e804d536358ac4b7e179e25f007b65fe94d0a511d4f0a1915e0a3df52fa0eab12
-
Filesize
319KB
MD5e2956d9884022ba9337d5cf092384370
SHA17e1394579b26d65c6b7fd016e8f68aa0f06c031b
SHA256a6a7367d09e7694e34df04c0f2d0203531993cf0735b5374fbdf8c1365cce0b4
SHA512bcbece48d22d66308c96718121e0faa54ef73d992de4379388be69592eceeb2dad911a0a195216748c78780c517f8e4e23195747d94e01ecec4089d7eb3c5e0b
-
Filesize
574KB
MD542badc1d2f03a8b1e4875740d3d49336
SHA1cee178da1fb05f99af7a3547093122893bd1eb46
SHA256c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf
SHA5126bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c
-
Filesize
3.1MB
MD595f8411e730341c5991aead206c9cb21
SHA19b5ea83e5a7f7189193aff72242f632781997790
SHA25608dd67d2034901c9de516f2fe4bafad3f6e81d312bfd96aea3c4e349019d4a22
SHA512f9d2a745a3a7a4e2b10d21bcc187a983f5a59b75eccf6ba02dba089ff3b84df870bbef4b59b780ac39b72988043c0d2d12f52ab9485ce9fea23a0a8f8d484ad1
-
\Users\Admin\AppData\Local\Temp\is-1QECD.tmp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp
Filesize3.0MB
MD573541c3ea8bf540604ee23cb0b93bc69
SHA131dc64100b034f0cd76edcabf01ca5ee8b552d39
SHA256172c967e2dd6b5598a36da5439f47d318a6336db1ac9de2bca33ed595fadbf70
SHA51224cdef59064274d9a6ffc1984609990aba17023064930badf0d4ecab30e53e35461e2776cbbc0681aa8947c1c704e6e875d4c8a2613f7673b1495dd35e3cd9e1