Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2024, 01:37

General

  • Target

    acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe

  • Size

    8.2MB

  • MD5

    289d273ac47a0259b639ff6d4782cab0

  • SHA1

    fed3a1db04bb8fe8104ff15d984d02cdbd0e360d

  • SHA256

    acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2

  • SHA512

    384bfe5eee39302ac9795550a5bdcbeecf409bc7eb92d5c55aa293ba56f6acbbc48585affd03ea124cb5a2b8d5aaa5d1741c3b98387325253cc22892a6b5b735

  • SSDEEP

    49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecX:V8e8e8f8e8e8s

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 4 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 61 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
    "C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe
      "C:\Users\Admin\AppData\Local\Temp\acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2N.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3060
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2864
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:452
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2196
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1584
              • \??\c:\windows\system\svchost.exe
                c:\windows\system\svchost.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2152
            • C:\Windows\SysWOW64\diskperf.exe
              "C:\Windows\SysWOW64\diskperf.exe"
              6⤵
                PID:2324
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2124
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2404
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2672
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:1800
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2532
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2072
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2752
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2616
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:952
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:1620
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2916
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2500
          • C:\Windows\SysWOW64\diskperf.exe
            "C:\Windows\SysWOW64\diskperf.exe"
            4⤵
              PID:1548
        • C:\Windows\SysWOW64\diskperf.exe
          "C:\Windows\SysWOW64\diskperf.exe"
          2⤵
            PID:2976

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

          Filesize

          8.2MB

          MD5

          289d273ac47a0259b639ff6d4782cab0

          SHA1

          fed3a1db04bb8fe8104ff15d984d02cdbd0e360d

          SHA256

          acf58236f1d7c59258698f29d3258349b83e14dd1073b8829ba9182774ee7ef2

          SHA512

          384bfe5eee39302ac9795550a5bdcbeecf409bc7eb92d5c55aa293ba56f6acbbc48585affd03ea124cb5a2b8d5aaa5d1741c3b98387325253cc22892a6b5b735

        • C:\Windows\system\explorer.exe

          Filesize

          8.2MB

          MD5

          c7609b202d0fc4b6cc45ed7e007f6805

          SHA1

          6ff5cc36f97573d6b705c116e9133a9dd574a33e

          SHA256

          2b4d389f6188c14c5d8376887da615e2c72f34dd836c83f2629c01d39692ebad

          SHA512

          819acd6b8b3fe70d37c9c10d5ec9abd548f59a4b00dd95b3c87f3ba85a0d7fc1d026805ff5d9899a54c78adb69584fb8c298e2522d64261503d9ebfd40b62829

        • \Windows\system\spoolsv.exe

          Filesize

          8.2MB

          MD5

          4b2cda7ab90b239f7228153f5f40e24c

          SHA1

          5979f873a0bd171864c917b0c25835dba0d03440

          SHA256

          e54d2167713ad04de9997b66638d67974405ef0143285b32d516a320cfa2cdc4

          SHA512

          368b0ec578decc87c9d62f256b1dfa5174fe556229806b964a87d4bbe58665ffd1e48dc7da02de49d0663d7f0a3c07555a97e6ad003ff3d004e5bdc0d612c81a

        • memory/452-164-0x0000000002E00000-0x0000000002F14000-memory.dmp

          Filesize

          1.1MB

        • memory/452-123-0x0000000002830000-0x0000000002944000-memory.dmp

          Filesize

          1.1MB

        • memory/452-122-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/452-95-0x0000000002830000-0x0000000002944000-memory.dmp

          Filesize

          1.1MB

        • memory/452-100-0x0000000002830000-0x0000000002944000-memory.dmp

          Filesize

          1.1MB

        • memory/452-242-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/452-144-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/452-153-0x0000000002E00000-0x0000000002F14000-memory.dmp

          Filesize

          1.1MB

        • memory/452-163-0x0000000002E00000-0x0000000002F14000-memory.dmp

          Filesize

          1.1MB

        • memory/1584-230-0x0000000002DE0000-0x0000000002EF4000-memory.dmp

          Filesize

          1.1MB

        • memory/1584-238-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2116-6-0x00000000003B0000-0x00000000003B1000-memory.dmp

          Filesize

          4KB

        • memory/2116-4-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2116-39-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2116-0-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2116-1-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2116-2-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2116-3-0x00000000003B0000-0x00000000003B1000-memory.dmp

          Filesize

          4KB

        • memory/2124-114-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2124-126-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2152-240-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2196-226-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2196-102-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2196-103-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2196-124-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2672-136-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-52-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-90-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-53-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-57-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-50-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2864-51-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2916-202-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2976-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2976-37-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2976-34-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2976-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2976-32-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/2976-28-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/3060-56-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/3060-48-0x0000000002EF0000-0x0000000003004000-memory.dmp

          Filesize

          1.1MB

        • memory/3060-10-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/3060-12-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/3060-14-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/3060-18-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/3060-24-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB