Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

7ac8fc19f2...7a.exe

windows7-x64

8

7ac8fc19f2...7a.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    146s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2024, 23:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe

  • Size

    119KB

  • MD5

    180176a8b7f136eb06915339c37f041e

  • SHA1

    c1b97c38056389eb6aa6cd57cce4540eb02c1b0e

  • SHA256

    7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a

  • SHA512

    2a810854f7c4eaa43a8cadd266659cae7bef3a51ae44ab3649d82950a2fe80b68f7dd3c19406e6a18fb146fbb6409ff16fc66e619d151cb07f2c465e74474b4b

  • SSDEEP

    3072:ROjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:RIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score
8/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
    "C:\Users\Admin\AppData\Local\Temp\7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2568
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\satornas.dll
    Filesize

    183B

    MD5

    66fa88b4c422da807c0dfb81d4566523

    SHA1

    7a310fa7e45a9589a44e65bb5f060f44e1a871b5

    SHA256

    1c824c0178a9a28b66bed3a6bf8606c84144b0909f407bfc7c1644dc7eb97f10

    SHA512

    25a82cc13faf5e3c0bf47c49651359ab79b59447ecd983d7e556cb36c29a6f7bbd1e37ddf91ab5b833ce80cbea0fd330d9632df1dba0d3a2150a4c4dd9bcb461

    Download Submit

  • \Windows\SysWOW64\ctfmen.exe
    Filesize

    4KB

    MD5

    596adf64a72203f37d7255774c939086

    SHA1

    b34677e18f8b39dad2fa5ec265159a1507cd2bed

    SHA256

    c400f40b23441ba93d0fe8a443d6b8c3494f825eec8ba242884632dd03ac9dd7

    SHA512

    853a215306865870a25f59eb662c7d49fed342e01bc6a443dddc0475af83701f44ed17a12090a0dfec553296158de04c58273e9e67684648b84646ba38040e0c

    Download Submit

  • \Windows\SysWOW64\shervans.dll
    Filesize

    8KB

    MD5

    056b2e99a0bca380dd8fff666b1203bf

    SHA1

    9c1da3131bf69801d30f14a924966ed573b9572e

    SHA256

    38201db858b692260488de5d4e9fd34fa8a572a94c1530032fd28677052f3cbe

    SHA512

    846f69ceb4a535cf704ac85d711c8868e33a711f249db00e694ce67cb48e6733463d1483e7e1b43a21e808095633abbd60f56583e49fb567c8f4dcd63a468a2c

    Download Submit

  • \Windows\SysWOW64\smnss.exe
    Filesize

    119KB

    MD5

    331efd5308599fb79d70cab9ef503478

    SHA1

    afe7ca069acf39299202cdadef15e8fc830b56f4

    SHA256

    cca9d265cd78e3d431d68a6ccdc7b1de74cf79891744daa421b43d1936679eaf

    SHA512

    ce254089524965c844965dc9a5e4daef52f4e795c9ffe3bd3221770bd18da3bfd5ef9ebde393fd4cdd94ff95253336593c3dfa512b521fab2a437426bfed2f90

    Download Submit

  • memory/1976-34-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/1976-29-0x0000000000320000-0x0000000000340000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2568-27-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2568-25-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2568-19-0x0000000000340000-0x0000000000349000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2568-0-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2568-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2780-40-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2780-43-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2780-42-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

    Download