Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2024, 19:12 UTC

General

  • Target

    04cdf9972803a3ca62d0799868921f3727d15b6a89325e69ab9386910ea1d43d.exe

  • Size

    361KB

  • MD5

    f10fd296b99bff4da1fbc7b80c5a901c

  • SHA1

    f6d59f98eea031a80c58ce9ac437b9f6181fbb68

  • SHA256

    04cdf9972803a3ca62d0799868921f3727d15b6a89325e69ab9386910ea1d43d

  • SHA512

    7b49f50a5779d6a304c28d7a9b27d68b397d0c548cc777bcde6cee0b565ac7ed68344f5c85fac542dbbd48bed6e9bba96617bfc763146147561f38be8a1d5bdf

  • SSDEEP

    6144:l2TV1wBuGKyaROfTgoGcJ25GUUCDHGJuMqjh6NG3q3p+ry28c8d/8kK:sbFA0oNYGUUEb0NG3lrgcQ/NK

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1064
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1128
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1152
          • C:\Users\Admin\AppData\Local\Temp\04cdf9972803a3ca62d0799868921f3727d15b6a89325e69ab9386910ea1d43d.exe
            "C:\Users\Admin\AppData\Local\Temp\04cdf9972803a3ca62d0799868921f3727d15b6a89325e69ab9386910ea1d43d.exe"
            2⤵
            • Modifies firewall policy service
            • UAC bypass
            • Windows security bypass
            • Windows security modification
            • Checks whether UAC is enabled
            • Enumerates connected drives
            • Drops autorun.inf file
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1640
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:284

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • F:\cgunsx.exe

            Filesize

            100KB

            MD5

            175a31d0d83c2814326627c577bb4cf9

            SHA1

            8778e8d62a6622b2bd9a2f5aeb7dabbf8b11635b

            SHA256

            bb138105616c29a1525bb400ac3808a5268125b7b8446c922ed937856f2c78f5

            SHA512

            ffb4f227d015c12c0114663ba3ce1019293b399e79a38a7d71bcd2a58f69a7381c563082572f0d0c6fd355f9764efde13124006b3faba105b1f2a0b52856d4e3

          • memory/1064-17-0x00000000020F0000-0x00000000020F2000-memory.dmp

            Filesize

            8KB

          • memory/1640-35-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-34-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-7-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-11-0x00000000005E0000-0x00000000005E1000-memory.dmp

            Filesize

            4KB

          • memory/1640-10-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-4-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-9-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-1-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-3-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-38-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-32-0x0000000003F10000-0x0000000003F12000-memory.dmp

            Filesize

            8KB

          • memory/1640-31-0x0000000003F10000-0x0000000003F12000-memory.dmp

            Filesize

            8KB

          • memory/1640-12-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-30-0x0000000004F20000-0x0000000004F21000-memory.dmp

            Filesize

            4KB

          • memory/1640-28-0x0000000004F20000-0x0000000004F21000-memory.dmp

            Filesize

            4KB

          • memory/1640-27-0x0000000003F10000-0x0000000003F12000-memory.dmp

            Filesize

            8KB

          • memory/1640-8-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-33-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-6-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-0-0x0000000000400000-0x0000000000512000-memory.dmp

            Filesize

            1.1MB

          • memory/1640-13-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-39-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-40-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-41-0x0000000000400000-0x0000000000512000-memory.dmp

            Filesize

            1.1MB

          • memory/1640-43-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-45-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-48-0x00000000005E0000-0x00000000005E1000-memory.dmp

            Filesize

            4KB

          • memory/1640-47-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-63-0x0000000005C30000-0x0000000005C31000-memory.dmp

            Filesize

            4KB

          • memory/1640-67-0x0000000005AE0000-0x0000000005AE2000-memory.dmp

            Filesize

            8KB

          • memory/1640-66-0x0000000003F10000-0x0000000003F12000-memory.dmp

            Filesize

            8KB

          • memory/1640-65-0x0000000000400000-0x0000000000512000-memory.dmp

            Filesize

            1.1MB

          • memory/1640-64-0x0000000005AE0000-0x0000000005AE2000-memory.dmp

            Filesize

            8KB

          • memory/1640-68-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-70-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-73-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          • memory/1640-85-0x0000000005AE0000-0x0000000005AE2000-memory.dmp

            Filesize

            8KB

          • memory/1640-5-0x0000000001E20000-0x0000000002EAE000-memory.dmp

            Filesize

            16.6MB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.