Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2024, 00:11

General

  • Target

    34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe

  • Size

    69KB

  • MD5

    61495fc6878dcd9aa17b177f2e727180

  • SHA1

    e85e35c72caedd3d93d32eb1720402a8fd36c655

  • SHA256

    34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cd

  • SHA512

    44fd0962e6a116e5cd4fc6408886621fd4a4351fef624ece183e14536f5979a41c7fe2f145a04e99fde29ab0e12aaa42563b811f15eedcea577b2a3ffcca3bc4

  • SSDEEP

    1536:TPyr5BWPJgzJrQsA4MJ8SS5gq9a2pJ+jZOb4W9nouy8aE:T6DJrXAnHmgMJ+dOnFoutaE

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe
    "C:\Users\Admin\AppData\Local\Temp\34ab31c06953e8710cbd0e818b1b6b40c5993901e7c584dfa98d3118a14442cdN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Users\Admin\AppData\Local\Temp\Sysceampbytw.exe
      "C:\Users\Admin\AppData\Local\Temp\Sysceampbytw.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475

    Filesize

    1KB

    MD5

    89488477da45f81f0c615e6f38027f45

    SHA1

    398e8b22b4b6cbfa12a661b6f08d7997bf9c66c4

    SHA256

    540762af47d9b6f3b36f20612b2aa57f54992279447f6f6ba732d739d442b703

    SHA512

    2329de7b26ec2591a07d773a2b1e38980d8820b056ac916441cabfe87177bf5576a2e65438ad86d1d339b31bcd6e057849f63911e06a0a0f4e09cb5adf4a5f59

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C

    Filesize

    471B

    MD5

    be2ae8a9d738667774406810e9474047

    SHA1

    abb5d75fbcfbf8fbfae4cbf00a8998a527e01f7e

    SHA256

    f38efc0a7fffa5640e03bf0adbb8388225e7580f5d01e6630bb6d83109187a68

    SHA512

    e5e10da017d491467f27fa7211eea836c6f1c2e383cf5d3d121e710b6ae8ee6570abb7fb9de20c897982497025da716e4eee21b501aa237f380984fad74cbf3f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AD5F118F7897046E8CA970AE6A6AB70B_A0B760D8ABF6F649D185B46E3E114CC2

    Filesize

    471B

    MD5

    011ddb737cff5db5a6c49b4b76524753

    SHA1

    7661adacc256199dedc2710f16d0a87a42ef22fe

    SHA256

    7e737c5606dd1bcea7cee237c4ffaa3d72e055794b8fd8dca99b4f15fbc0e5a5

    SHA512

    3c694ff56719783d966fc4a29cf7d2e15b0626b5a276f5ee703af717ddf013d8b7068092a47a9563816c6c2b00283150a997a5d864a9c09af2fb93f9c5535b77

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CF14D1855652602540DFCFECD21854DB_54BE0F4A529F65D13ED30F3AD0874E58

    Filesize

    1KB

    MD5

    ac3df84c0f0b75fd8f33a0e4c7db6c60

    SHA1

    c1e99536a94bf9f1847728ffc0afec220c5469d8

    SHA256

    1a331d0154a88426a4fe00be5312d99e0209965c732ccbd5fa5f2aeb0a3504b3

    SHA512

    2f686f9ec7c71de697ec6f544bc821219f8070064c75a6900e155149f1494fece8395381acb5c36b336ecf0f1e86a2b0cb8dd45d3735f1855619c28a29c1dfea

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475

    Filesize

    500B

    MD5

    baddb1f9736a0bdffbcd65f18c1713b1

    SHA1

    abb85729274886a7a9fcf204c84d96383430c30d

    SHA256

    a2a9d558bb0515065c97b3f2bed084f6d70c70cb0a887d994084976ee75e1575

    SHA512

    16352312bbce558bb35bcca143a89bb978f3e1ca0c77596de451db1a49b29950a23eb31829714cc612cfc1b74be0858b1163022076307d96c227a6fb1bdacf15

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_896832C6BC857CFAEA9E59E166B13E2C

    Filesize

    398B

    MD5

    9dcd3cdddbe7ccb302c17b29b18ea58d

    SHA1

    e0d91b872c79d2b6dc15c71f93fb1c7493419e95

    SHA256

    e05556979777f97b794a73daa2b7374c738b8200a8fd167d2acb5a38e79356c3

    SHA512

    b460d4f2b27e6662c5bc1a6a72d2d7ab78cd33ee16e572ebf953b93f7fd403f66fa92c15c5f50bfb6435f1e0151bfc2feaedc73aaf4aa7a056ccb79cc233a04e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AD5F118F7897046E8CA970AE6A6AB70B_A0B760D8ABF6F649D185B46E3E114CC2

    Filesize

    410B

    MD5

    deaf1dbfe76e8266d36d68f0be95875b

    SHA1

    e011a3a03f1eb91c89ede694d3b26501793d9131

    SHA256

    9b907fcaead210a2f6b16959e646074d9fadea961c454f9f6accb4f35b3f1c60

    SHA512

    a062f831e3d845d13738697688f0f8afd487f37aefb0752159ae9d544b6586955bf1b14740dea9f243968fab113ea6fa098e75ea8d5cff0df3adedb3773a21a9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CF14D1855652602540DFCFECD21854DB_54BE0F4A529F65D13ED30F3AD0874E58

    Filesize

    536B

    MD5

    ff3d2d63048c8600b77c3e54737a43e8

    SHA1

    f7489b20990d842ec567420c4ee223e24adfd8f3

    SHA256

    f7c5615d0980ad9cfa82fa8b66a457a6cbc9c33a67835c54619c42bf566c3cde

    SHA512

    a0bc4546af7ba32e072a1f0d1869611b97cece21c02c582ca84cf3db410d2e1c89387fe1548a386fbb963a7646180f9acabcb88f5117ebad55e4c18c841d4b33

  • C:\Users\Admin\AppData\Local\Temp\CabDEFA.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Sysceampbytw.exe

    Filesize

    69KB

    MD5

    af2e1eb9cdbbc4ce32ec07b9632a906e

    SHA1

    8bce6fb71562ab0f1cee417ea579a7450be386b3

    SHA256

    3c7706006d553e7907b00dc8e59af4358c55fa2b9596f1c6e1d61d617d4ed8a0

    SHA512

    3020c56053306fc3b71873458b7af0d3eca354c0417e8baad2011248fa9ceea84e614033d60484d74e34a3ee36a78bfa9275bec2d1a984559a0164ca8a923920

  • C:\Users\Admin\AppData\Local\Temp\cpath.ini

    Filesize

    103B

    MD5

    bacd264fb7d6aecdda7eae67a1e762fe

    SHA1

    d9cac2380538bbf65d8cac58b42fb31c4fa61ec9

    SHA256

    082e33d268c4ab1ad3f1412f2951bda31b64850a8ad46670fe855642e7602890

    SHA512

    cd9c6774fb00e4fdb541800847cc38fd690de139a7c64050223a2f14aa6366223d070315937310deb1aacf4cfa98487d2303ec5d9f1fd2c29c824d06a7ed9a21

  • memory/1984-0-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/1984-57-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/1984-41-0x0000000003DC0000-0x0000000003E28000-memory.dmp

    Filesize

    416KB

  • memory/1984-40-0x0000000003DC0000-0x0000000003E28000-memory.dmp

    Filesize

    416KB

  • memory/1984-27-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

  • memory/2888-65-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB