Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 03:20

General

  • Target

    5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe

  • Size

    276KB

  • MD5

    2721d2dc342221266f426ebd6a4f90d0

  • SHA1

    a35f0e094b0874b8102e88759fdbf615a4acc615

  • SHA256

    5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76

  • SHA512

    6e877432dd6b4060e7537689b15ccceb1909444a1cd44b6953d00bec94e244f477019d60764bd73d8015992e5985afbeaf1f66b58eb54e9dada5e4c2bc531c81

  • SSDEEP

    6144:esaocyLCJdsc9jO0HqzcRc7vBgEhC3U+zV5Di+L9ymRNF:etobGdtZG6czek8Vo+xyS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe
    "C:\Users\Admin\AppData\Local\Temp\5e7b2ee24c0a19ed58248822ca0e65ca40d154f35ff67d704ee209cd52856d76N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Users\Admin\AppData\Local\Temp\nso9A5E.tmp\i5.exe
      C:\Users\Admin\AppData\Local\Temp\nso9A5E.tmp\i5.exe 50b892e5-d96c-476b-834e-555c5bc06f2f.exe /t /dT131970150S /e5758413 /u50b892e5-d96c-476b-834e-555c5bc06f2f
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Users\Admin\AppData\Local\Temp\nso9A5E.tmp\50b892e5-d96c-476b-834e-555c5bc06f2f.exe
        "C:\Users\Admin\AppData\Local\Temp\nso9A5E.tmp\50b892e5-d96c-476b-834e-555c5bc06f2f.exe" /t /dT131970150S /e5758413 /u50b892e5-d96c-476b-834e-555c5bc06f2f
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\12236C41CDDF9E40BA5606CDF086B821

    Filesize

    74KB

    MD5

    6e686cff09f02fca79da6d9fbee366f1

    SHA1

    d7d0694603d6ef99050c3ce5e95d27f25b4efe2e

    SHA256

    f12fbe11b90fdf53a446db5b62e90efaff1aa68e0c3e81e41e8b628211f6fc02

    SHA512

    41717d36a54df996c838ea8b7aae4faf48096a92fee58e0a41a1e0dba8065a11e38a267a7c59b8a42c89c1cca43d08c320633b41c4fe6e03e40609713f982199

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EDCF682921FE94F4A02A43CD1A28E6B

    Filesize

    604B

    MD5

    3a0e39c53630ecfc2720aee27fe32557

    SHA1

    ce9b2fbd4efce495b07ac98b4cb54b12dd3cf3c0

    SHA256

    18da8779683e3e688ac75a896d738eb4e958763e153e56cb06432bafd3d6ef38

    SHA512

    3598a8fa245b68d4ea236355c00c80710105704efb08e889edea0afd79e079224083c0d034e6b2454189bb8057ea9037ae48e0791bc5b6c54a4af90541fda166

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\12236C41CDDF9E40BA5606CDF086B821

    Filesize

    202B

    MD5

    bc16d54d5eac63b24641999170f89662

    SHA1

    e4e2d14587a06b63edb8df805cec40f11e9cc18f

    SHA256

    82b3041c27a10badb8ff739c0e1c574f5ec86ee8adb6271cffc0f400dba68199

    SHA512

    708b4cc0f51d4bc9db95af669be7125c97c3e952869119ca29226c8fdf644824e17f16970e75c22fd09c126a030c91189466291b91b89c1191be7c2abfb6dc4e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EDCF682921FE94F4A02A43CD1A28E6B

    Filesize

    188B

    MD5

    8f747ae8ae6c78ee839c1ccde1f6de1c

    SHA1

    8867a2b77a326ab88ad6516b831c9a35b7cd6ece

    SHA256

    2f896d576ac24a9e5b1e735683e7d985765113e343c789b4472040096c8b3d43

    SHA512

    e3dfc29ad6d70e005027caf83df661d3e0041c6d0205dd7ea14b1d973a12d8e5db1ee7a624571a2d0240c94304e4eb1ca9bc66b6e17f371d0feeb4adc7db6eb9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d30940d6c16529a6e9ca33e6dcf0c169

    SHA1

    3547296a78b0e59bbbb56d807ab4b1ef5cca23a9

    SHA256

    13fad99b4deee509abe73784c48fc1d7f196c303bfbcc86b927de28fa13f53e4

    SHA512

    076b9d4578ef72a3661a5ab8d01e90e800eba255a9360bec9be7feaa7b008886f5a3bdfc02b46cad64efcccf2cbec22ae6fd189449e121acc76048de7a5d4171

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9

    Filesize

    404B

    MD5

    50f9a597ea99e6cf51ddde22cd2ae185

    SHA1

    76ad10f47383acd21ff925e92e19db034c7f91bd

    SHA256

    6d8b0cc2092f92e524d2b88eab590482babbe7f537a70c0e9f74c67c07264843

    SHA512

    83d3f6f3b66a7c86d0744114683eab30ddf4256edcef4ce60a94762fb54c387e5cdb557278445ed8fe47d5e2b893d35a143f86b23277de65b224b120d6c80cb9

  • C:\Users\Admin\AppData\Local\Temp\Cab9CFD.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar9D1F.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\nso9A5E.tmp\50b892e5-d96c-476b-834e-555c5bc06f2f.exe

    Filesize

    256KB

    MD5

    6e68cf541f031c7de9da6ec8d86862aa

    SHA1

    115f143b5f585a27006159dc1b2d4d23a7af5295

    SHA256

    d1763b911eebce060a4c479190e83ff5747f5e75f938fb1cb23d5fcaba249e35

    SHA512

    022af872f2343293a0d71c6cc3ca3f13001ce7ad8e04cf740b75574272cad1dcb40a97a0e860082e7080a69a0367438728f1983317349d5a33ca969c3d877de1

  • \Users\Admin\AppData\Local\Temp\nso9A5E.tmp\i5.exe

    Filesize

    214KB

    MD5

    0b168b79397a1c3d5a181787e27ea323

    SHA1

    1867e953755169de011fd12009c2f42f300a9d47

    SHA256

    c681e32d308452ee7c24eeebb335ee86cfe42783db2289ef2caa0d0671b53d5a

    SHA512

    3b3e2ff7ad58a677cfbd22dec0c294e0b27ec0b81e8e6e20f45ac228c90472318ec0bec15d6689180b73061b94ea750049688ee5ed95a4e1d205eb94e7d0a250

  • \Users\Admin\AppData\Local\Temp\nso9A5E.tmp\nsExec.dll

    Filesize

    8KB

    MD5

    249ae678f0dac4c625c6de6aca53823a

    SHA1

    6ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201

    SHA256

    7298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce

    SHA512

    66e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7

  • memory/2032-11-0x00000000741D1000-0x00000000741D2000-memory.dmp

    Filesize

    4KB

  • memory/2032-12-0x00000000741D0000-0x000000007477B000-memory.dmp

    Filesize

    5.7MB

  • memory/2032-20-0x00000000741D0000-0x000000007477B000-memory.dmp

    Filesize

    5.7MB

  • memory/2032-95-0x00000000741D0000-0x000000007477B000-memory.dmp

    Filesize

    5.7MB

  • memory/2960-99-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB