Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    06/10/2024, 04:26

General

  • Target

    f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe

  • Size

    1.8MB

  • MD5

    2f91a52ce172b10c730387788b06358d

  • SHA1

    e22f66c120f19156cd143b35b565ad5956ae6013

  • SHA256

    f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2

  • SHA512

    0bd96b3af646bbec0429a6747b96fa6e28f66477b0a7c40af4a7f2ecdc7ccac5681ca3300cb10d7e66cb62a3a3fd88b963660388a262868b38f30acace5e2eca

  • SSDEEP

    24576:04nXubIQGyxbPV0db26WoJVEuvsv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdO:0qe3f6S9SffPMWrQ0Zk

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe
    "C:\Users\Admin\AppData\Local\Temp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Users\Admin\AppData\Local\Temp\is-1QECD.tmp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-1QECD.tmp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp" /SL5="$400F8,1074986,831488,C:\Users\Admin\AppData\Local\Temp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Windows\SysWOW64\taskkill.exe
        "taskkill" https://setstat.ru/api/savePostback?chid=%s&guid=%s&type=vkdjbin.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:3020
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /Create /TN principal-plus /SC ONLOGON /TR "C:\ProgramData\ports-postal\bin.exe /H" /F /DELAY 0001:00 /RL HIGHEST
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:572
      • C:\Users\Admin\AppData\Local\Temp\is-6TU5C.tmp\7za.exe
        "C:\Users\Admin\AppData\Local\Temp\is-6TU5C.tmp\7za.exe" e "C:\Users\Admin\AppData\Local\Temp\is-6TU5C.tmp\5.14.zip" -pvkd -y -oC:\ProgramData\ports-postal
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1392
      • C:\ProgramData\ports-postal\bin.exe
        "C:\ProgramData\ports-postal\bin.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\ports-postal\bin.exe

    Filesize

    9.7MB

    MD5

    2e9b855fd40c1730ead9dbe3942a8d53

    SHA1

    406de9e251c4d61dbb89bcbb0f6d36c1f61ebcb8

    SHA256

    7e15514285906a7092ba879dcc4db88e2f9e1356846ca983fa33d05d8b28ecb3

    SHA512

    dd706ea30041c4bade58d8df49126c63967deed204bf76edc9e9bebd1c9736447965d5c935df9c687eed9f9fbd60fdb61349d939b78576d4d918a34036054e8f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

    Filesize

    717B

    MD5

    822467b728b7a66b081c91795373789a

    SHA1

    d8f2f02e1eef62485a9feffd59ce837511749865

    SHA256

    af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

    SHA512

    bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24E728EA67A1638D93C3A7ACDB892D04

    Filesize

    504B

    MD5

    9be9036404a0746236e1093079c424d6

    SHA1

    5e25f29fa44b5abf8b7868d5422f624ef3aa2e59

    SHA256

    b36ffa5740f4949b4b6f04990285774837c12faa5a7f8fade4f8733de9805ce4

    SHA512

    6a6ab23e3e3e16dd76a2c35cb31543dad46ac8d6427b83ab443f66feda9f794b3ca0dcf2233f10e6018c7c78cd1c7116e5289d6d31a0a05ee92da32435d0b7c8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

    Filesize

    192B

    MD5

    828bf3e77ac772c62540e7ef8a15a689

    SHA1

    18d79f2d6c94f19dcfdac041d1b79457d8f61ed8

    SHA256

    a8cb9a6d81daad551d92b4287b4e71f7ce5e9e9c8fcb4296dda5f9242f239943

    SHA512

    79e14f70fcdb9a7046dccdc7ed1816edd30793514cdc728e697cab8007f762b2c8f3eac00009d50e20b99b741f42ef14cdf0ad64081b4a3df08970a13eb14a50

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24E728EA67A1638D93C3A7ACDB892D04

    Filesize

    550B

    MD5

    c7317a0dd3827e85ec20094bcf079b2c

    SHA1

    aa585ad26a7b34ec5bcc47fda71875e8c79847da

    SHA256

    a86560f3562639fa2542ac3cf9c9716ed8bdf0559314635afea6cd17351cbae8

    SHA512

    1888ce48d668a34b60c3b4a3d9bcdbb9bef36821373f5eb9943d062d004bee6a1ebff9f2401517a98b57ae933c051520ff563bc3ed24f48f1c60b4878b6b0434

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f40fde7885f14cb741f31a7a01a038ec

    SHA1

    f391a1b4ba8bc2a4c01aa73b8ed818e0476a9316

    SHA256

    2c055298e5ec6fb998423b59c693451c8a07c4bd2e89899511ec81e8c9baa4ff

    SHA512

    4946e407be0d837a58d2d727224ef8a592f1f5e4174645e97ca2225866b848558cd90c182b765651a7ed3e5bb66b7828313f4b2f550125263586e5f8eec11035

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8B420DKQ\downloader[1]

    Filesize

    203KB

    MD5

    b9314504e592d42cb36534415a62b3af

    SHA1

    059d2776f68bcc4d074619a3614a163d37df8b62

    SHA256

    c60c3a7d20b575fdeeb723e12a11c2602e73329dc413fc6d88f72e6f87e38b49

    SHA512

    e50adb690e2f6767001031e83f40cc067c9351d466051e45a40a9e7ff49049e35609f1e70dd7bb4a4721a112479f79090decca6896deac2680e7d107e3355dae

  • C:\Users\Admin\AppData\Local\Temp\Cab517A.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\is-6TU5C.tmp\5.14.zip

    Filesize

    3.6MB

    MD5

    22f982f6129b7e8ddc2212041530e609

    SHA1

    bef494910b3f0e48741ae8ab7af537d15296d096

    SHA256

    c8519331e74fb0b204c7be4033d8bf448bd6bd15f16ad420debb5e4bd4076717

    SHA512

    28394a4d4d6c53511e07a0ce0c0fc9ffe02e0de8e5aad588b46f37c4b7d5036e804d536358ac4b7e179e25f007b65fe94d0a511d4f0a1915e0a3df52fa0eab12

  • C:\Users\Admin\AppData\Local\Temp\is-6TU5C.tmp\5.14.zip

    Filesize

    319KB

    MD5

    e2956d9884022ba9337d5cf092384370

    SHA1

    7e1394579b26d65c6b7fd016e8f68aa0f06c031b

    SHA256

    a6a7367d09e7694e34df04c0f2d0203531993cf0735b5374fbdf8c1365cce0b4

    SHA512

    bcbece48d22d66308c96718121e0faa54ef73d992de4379388be69592eceeb2dad911a0a195216748c78780c517f8e4e23195747d94e01ecec4089d7eb3c5e0b

  • C:\Users\Admin\AppData\Local\Temp\is-6TU5C.tmp\7za.exe

    Filesize

    574KB

    MD5

    42badc1d2f03a8b1e4875740d3d49336

    SHA1

    cee178da1fb05f99af7a3547093122893bd1eb46

    SHA256

    c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf

    SHA512

    6bc519a7368ee6bd8c8f69f2d634dd18799b4ca31fbc284d2580ba625f3a88b6a52d2bc17bea0e75e63ca11c10356c47ee00c2c500294abcb5141424fc5dc71c

  • \ProgramData\ports-postal\unins000.exe

    Filesize

    3.1MB

    MD5

    95f8411e730341c5991aead206c9cb21

    SHA1

    9b5ea83e5a7f7189193aff72242f632781997790

    SHA256

    08dd67d2034901c9de516f2fe4bafad3f6e81d312bfd96aea3c4e349019d4a22

    SHA512

    f9d2a745a3a7a4e2b10d21bcc187a983f5a59b75eccf6ba02dba089ff3b84df870bbef4b59b780ac39b72988043c0d2d12f52ab9485ce9fea23a0a8f8d484ad1

  • \Users\Admin\AppData\Local\Temp\is-1QECD.tmp\f66cce75057b8b516e1d2aa0a24f32361cdf7494ace1a6622fc96c54db38b5e2.tmp

    Filesize

    3.0MB

    MD5

    73541c3ea8bf540604ee23cb0b93bc69

    SHA1

    31dc64100b034f0cd76edcabf01ca5ee8b552d39

    SHA256

    172c967e2dd6b5598a36da5439f47d318a6336db1ac9de2bca33ed595fadbf70

    SHA512

    24cdef59064274d9a6ffc1984609990aba17023064930badf0d4ecab30e53e35461e2776cbbc0681aa8947c1c704e6e875d4c8a2613f7673b1495dd35e3cd9e1

  • memory/848-161-0x0000000000400000-0x0000000000DBF000-memory.dmp

    Filesize

    9.7MB

  • memory/2264-2-0x0000000000401000-0x00000000004B7000-memory.dmp

    Filesize

    728KB

  • memory/2264-0-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/2264-160-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/2264-134-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/2376-8-0x0000000000400000-0x000000000071A000-memory.dmp

    Filesize

    3.1MB

  • memory/2376-136-0x0000000000400000-0x000000000071A000-memory.dmp

    Filesize

    3.1MB

  • memory/2376-159-0x0000000000400000-0x000000000071A000-memory.dmp

    Filesize

    3.1MB