Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

13f8bb1af7...be.exe

windows7-x64

10

49b84085b7...c6.exe

windows7-x64

10

639a86559b...3d.exe

windows7-x64

10

Счет �...15.scr

windows7-x64

3

Счет �...08.scr

windows7-x64

3

inquiry.scr

windows7-x64

9

c0cf40b883...3a.exe

windows7-x64

8

e49778d20a...73.exe

windows7-x64

8

ПРЕТЕ...Я.scr

windows7-x64

5

карто...я.scr

windows7-x64

5

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2024, 20:50 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe

  • Size

    370KB

  • MD5

    a890e2f924dea3cb3e46a95431ffae39

  • SHA1

    35719ee58a5771156bc956bcf1b5c54ac3391593

  • SHA256

    c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a

  • SHA512

    664fb8075712912be30185d17d912dae148e778627e852affe1b1080bb9c8d5917e7b3c1d194e62ac6919c16235754f776523ba7ce95af38be86b61cc3e3d162

  • SSDEEP

    6144:KRzMgpY8bXFHW1FbwwEHidUoagoW2C9cuqBGI4Zq6mYN8+G5l9PAzJdVeO2Ui:sDRbXFHW1+K2UWBGIymYG+i9A+ONi

Score
8/10
discoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 3 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
    "C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\YCXBF.bat" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:768
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1884

Network

  • flag-us
    DNS
    shopping-na-divane.ru
    c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
    Remote address:
    8.8.8.8:53
    Request
    shopping-na-divane.ru
    IN A
    Response
  • flag-us
    DNS
    shoptorgvlg.ru
    c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
    Remote address:
    8.8.8.8:53
    Request
    shoptorgvlg.ru
    IN A
    Response
No results found
  • 8.8.8.8:53
    shopping-na-divane.ru
    dns
    c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
    67 B
     128 B
     1
    1

    DNS Request

    shopping-na-divane.ru

  • 8.8.8.8:53
    shoptorgvlg.ru
    dns
    c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe
    60 B
     121 B
     1
    1

    DNS Request

    shoptorgvlg.ru

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\YCXBF.bat
    Filesize

    309B

    MD5

    c6973a52b7dd549a68cafbb66101bf8e

    SHA1

    3ce4ca3d03d759f2aa1af5f05438e69262711148

    SHA256

    89574c6e2631ff3798ad11b94e78a6f60819a68259f853903595ed68fc5018d7

    SHA512

    4943d044338a6a635e7d1eef2add5b40a3869d0b960e0e940b937194b4ecb10d5273122c6dcc98bbfb6c5ae9af089bc806632979c4425062bed40afff8cc3473

    Download Submit

  • memory/2344-3-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

  • memory/2344-787-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

  • memory/2344-1448-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

  • memory/2344-1693-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

  • memory/2344-1781-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

  • memory/2344-1782-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

  • memory/2344-1797-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.