Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/10/2024, 01:47
Static task
static1
Behavioral task
behavioral1
Sample
df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe
Resource
win7-20240903-en
General
-
Target
df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe
-
Size
79KB
-
MD5
b39589f9343b509a07a49f759cb71630
-
SHA1
918aecfca8251c09ed87ff918fe0b6e117be79f2
-
SHA256
df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cd
-
SHA512
f3e0548dba15a50394bfad22347df3909eb0ede869c732a722b6b8c64355b300baf482711f268c95b3ea2ccd0d8f4e2581356a8aa14ef162058e5d43beb75ba3
-
SSDEEP
1536:ml531xxqA3zM9ttjtt574bbp8Fm43AOEI0QdeFUU8te5:4lnhYPlVMqmyAFIRRy
Malware Config
Extracted
urelas
112.175.88.208
112.175.88.207
Signatures
-
Deletes itself 1 IoCs
pid Process 2460 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 532 huter.exe -
Loads dropped DLL 1 IoCs
pid Process 1724 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language huter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1724 wrote to memory of 532 1724 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 30 PID 1724 wrote to memory of 532 1724 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 30 PID 1724 wrote to memory of 532 1724 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 30 PID 1724 wrote to memory of 532 1724 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 30 PID 1724 wrote to memory of 2460 1724 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 31 PID 1724 wrote to memory of 2460 1724 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 31 PID 1724 wrote to memory of 2460 1724 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 31 PID 1724 wrote to memory of 2460 1724 df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe"C:\Users\Admin\AppData\Local\Temp\df3c55c2a7b88a0806ee417d666b169e623202ab41beb28f02775e7faad1d7cdN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\huter.exe"C:\Users\Admin\AppData\Local\Temp\huter.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:532
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5dd1155cbc9956e5dbeee97b18e3c4c5a
SHA1e5f61bc0d1bc9ad93206ea16ddefca0900ea780c
SHA25653be558f961cb503bea4e622d7833128bb01c698cc3cc6d3ec9b1cf1bafe72b7
SHA5121e384513a0d2bb4d797d714f93afdf69efb2be05217fd6b5f421fc3f776ec89431b20d5a82e731d7d78c7d4f8fae3ab49880b524844b3c5e16281fa83d00a1ce
-
Filesize
340B
MD5d6b71bd88f9654567f0c65423b7d9a73
SHA19fff28cb119fba7d1b4402c354ec63083aff1270
SHA256cb16e3fe444d1fbe4891907cdd33a5b46389478d101f9772f84ed6c35407dd95
SHA5124082ba1d2eabecbccc618f08993bdd491fab02a7f58a268bd559002aa8114e8d303274f5cde2c3a8701244dbe8f59c4fff778b9df7fec21475c4ddd6726d87e1
-
Filesize
79KB
MD573b76c98d84a46cbc55f319df58887e4
SHA156b6b31b54cac5ec2908879cb6d4b757e8a47138
SHA256c00ee30609fb6a0769327c9e6c74c737628908932a56053cc1fe2bcd9525607f
SHA512a7ead8dbe37f7b752f81e8220514ca33007641683ce2db21994062d0f223b625bfa4ae13d36be86963a767d1dbcdd4b96d2588a482d7034549afe4e6bf8cee7b