Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 00:11
Behavioral task
behavioral1
Sample
34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe
Resource
win7-20240903-en
General
-
Target
34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe
-
Size
69KB
-
MD5
61495fc6878dcd9aa17b177f2e727180
-
SHA1
e85e35c72caedd3d93d32eb1720402a8fd36c655
-
SHA256
34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cd
-
SHA512
44fd0962e6a116e5cd4fc6408886621fd4a4351fef624ece183e14536f5979a41c7fe2f145a04e99fde29ab0e12aaa42563b811f15eedcea577b2a3ffcca3bc4
-
SSDEEP
1536:TPyr5BWPJgzJrQsA4MJ8SS5gq9a2pJ+jZOb4W9nouy8aE:T6DJrXAnHmgMJ+dOnFoutaE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 3 IoCs
resource yara_rule behavioral1/memory/1984-27-0x0000000000400000-0x0000000000468000-memory.dmp family_blackmoon behavioral1/memory/1984-57-0x0000000000400000-0x0000000000468000-memory.dmp family_blackmoon behavioral1/memory/2888-65-0x0000000000400000-0x0000000000468000-memory.dmp family_blackmoon -
Executes dropped EXE 1 IoCs
pid Process 2888 Sysceampbytw.exe -
Loads dropped DLL 2 IoCs
pid Process 1984 34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe 1984 34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe -
resource yara_rule behavioral1/memory/1984-0-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/1984-27-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/files/0x0005000000019467-35.dat upx behavioral1/memory/1984-57-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral1/memory/2888-65-0x0000000000400000-0x0000000000468000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sysceampbytw.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe 2888 Sysceampbytw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2888 1984 34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe 32 PID 1984 wrote to memory of 2888 1984 34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe 32 PID 1984 wrote to memory of 2888 1984 34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe 32 PID 1984 wrote to memory of 2888 1984 34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe"C:\Users\Admin\AppData\Local\Temp\34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\Sysceampbytw.exe"C:\Users\Admin\AppData\Local\Temp\Sysceampbytw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475
Filesize1KB
MD589488477da45f81f0c615e6f38027f45
SHA1398e8b22b4b6cbfa12a661b6f08d7997bf9c66c4
SHA256540762af47d9b6f3b36f20612b2aa57f54992279447f6f6ba732d739d442b703
SHA5122329de7b26ec2591a07d773a2b1e38980d8820b056ac916441cabfe87177bf5576a2e65438ad86d1d339b31bcd6e057849f63911e06a0a0f4e09cb5adf4a5f59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C
Filesize471B
MD5be2ae8a9d738667774406810e9474047
SHA1abb5d75fbcfbf8fbfae4cbf00a8998a527e01f7e
SHA256f38efc0a7fffa5640e03bf0adbb8388225e7580f5d01e6630bb6d83109187a68
SHA512e5e10da017d491467f27fa7211eea836c6f1c2e383cf5d3d121e710b6ae8ee6570abb7fb9de20c897982497025da716e4eee21b501aa237f380984fad74cbf3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_A0B760D8ABF6F649D185B46E3E114CC2
Filesize471B
MD5011ddb737cff5db5a6c49b4b76524753
SHA17661adacc256199dedc2710f16d0a87a42ef22fe
SHA2567e737c5606dd1bcea7cee237c4ffaa3d72e055794b8fd8dca99b4f15fbc0e5a5
SHA5123c694ff56719783d966fc4a29cf7d2e15b0626b5a276f5ee703af717ddf013d8b7068092a47a9563816c6c2b00283150a997a5d864a9c09af2fb93f9c5535b77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CF14D1855652602540DFCFECD21854DB_54BE0F4A529F65D13ED30F3AD0874E58
Filesize1KB
MD5ac3df84c0f0b75fd8f33a0e4c7db6c60
SHA1c1e99536a94bf9f1847728ffc0afec220c5469d8
SHA2561a331d0154a88426a4fe00be5312d99e0209965c732ccbd5fa5f2aeb0a3504b3
SHA5122f686f9ec7c71de697ec6f544bc821219f8070064c75a6900e155149f1494fece8395381acb5c36b336ecf0f1e86a2b0cb8dd45d3735f1855619c28a29c1dfea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475
Filesize500B
MD5baddb1f9736a0bdffbcd65f18c1713b1
SHA1abb85729274886a7a9fcf204c84d96383430c30d
SHA256a2a9d558bb0515065c97b3f2bed084f6d70c70cb0a887d994084976ee75e1575
SHA51216352312bbce558bb35bcca143a89bb978f3e1ca0c77596de451db1a49b29950a23eb31829714cc612cfc1b74be0858b1163022076307d96c227a6fb1bdacf15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C
Filesize398B
MD59dcd3cdddbe7ccb302c17b29b18ea58d
SHA1e0d91b872c79d2b6dc15c71f93fb1c7493419e95
SHA256e05556979777f97b794a73daa2b7374c738b8200a8fd167d2acb5a38e79356c3
SHA512b460d4f2b27e6662c5bc1a6a72d2d7ab78cd33ee16e572ebf953b93f7fd403f66fa92c15c5f50bfb6435f1e0151bfc2feaedc73aaf4aa7a056ccb79cc233a04e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_A0B760D8ABF6F649D185B46E3E114CC2
Filesize410B
MD5deaf1dbfe76e8266d36d68f0be95875b
SHA1e011a3a03f1eb91c89ede694d3b26501793d9131
SHA2569b907fcaead210a2f6b16959e646074d9fadea961c454f9f6accb4f35b3f1c60
SHA512a062f831e3d845d13738697688f0f8afd487f37aefb0752159ae9d544b6586955bf1b14740dea9f243968fab113ea6fa098e75ea8d5cff0df3adedb3773a21a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CF14D1855652602540DFCFECD21854DB_54BE0F4A529F65D13ED30F3AD0874E58
Filesize536B
MD5ff3d2d63048c8600b77c3e54737a43e8
SHA1f7489b20990d842ec567420c4ee223e24adfd8f3
SHA256f7c5615d0980ad9cfa82fa8b66a457a6cbc9c33a67835c54619c42bf566c3cde
SHA512a0bc4546af7ba32e072a1f0d1869611b97cece21c02c582ca84cf3db410d2e1c89387fe1548a386fbb963a7646180f9acabcb88f5117ebad55e4c18c841d4b33
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
69KB
MD5af2e1eb9cdbbc4ce32ec07b9632a906e
SHA18bce6fb71562ab0f1cee417ea579a7450be386b3
SHA2563c7706006d553e7907b00dc8e59af4358c55fa2b9596f1c6e1d61d617d4ed8a0
SHA5123020c56053306fc3b71873458b7af0d3eca354c0417e8baad2011248fa9ceea84e614033d60484d74e34a3ee36a78bfa9275bec2d1a984559a0164ca8a923920
-
Filesize
103B
MD5bacd264fb7d6aecdda7eae67a1e762fe
SHA1d9cac2380538bbf65d8cac58b42fb31c4fa61ec9
SHA256082e33d268c4ab1ad3f1412f2951bda31b64850a8ad46670fe855642e7602890
SHA512cd9c6774fb00e4fdb541800847cc38fd690de139a7c64050223a2f14aa6366223d070315937310deb1aacf4cfa98487d2303ec5d9f1fd2c29c824d06a7ed9a21