Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2025, 13:50

General

  • Target

    idle_master_extended_v1.5.zip

  • Size

    1.3MB

  • MD5

    27cd6ff4cc23d22d5352023def285ce3

  • SHA1

    4d70059d333d7ceed8f9fbaff2b12c9761d40bb6

  • SHA256

    a9b434b8acdad1d2cf583c8e0c4e1218ee1d7eb46a7925cafab9edd01b62dddf

  • SHA512

    e09cf38c87697dd5d794d14d6b45de302c249e7b7dac5159b43fbc04c7b8fa1511af2aead9542b1fb7d69b3baff339d8725e109202aa16dc79d233180e379658

  • SSDEEP

    24576:7Pds/dz2DS5PUKKTaMupDPIJPS//PYmuYXzSvDs9Aiy3ySqiaOD:70dJ6KLxp7kS/33pXzoI99CJki

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Detected potential entity reuse from brand STEAM.
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\idle_master_extended_v1.5.zip"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Users\Admin\AppData\Local\Temp\7zOC260ABA8\IdleMaster.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC260ABA8\IdleMaster.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      PID:912
    • C:\Users\Admin\AppData\Local\Temp\7zOC26A1EB8\IdleMaster.exe
      "C:\Users\Admin\AppData\Local\Temp\7zOC26A1EB8\IdleMaster.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2400
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2264
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4e8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:960

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

      Filesize

      734B

      MD5

      e192462f281446b5d1500d474fbacc4b

      SHA1

      5ed0044ac937193b78f9878ad7bac5c9ff7534ff

      SHA256

      f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60

      SHA512

      cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

      Filesize

      192B

      MD5

      fb15d233c3f1c24a5ca19d3444eb5508

      SHA1

      2ff62d953cc3e5ef2dd203db4c1b79cdf8c9fcdb

      SHA256

      95eb4e74cd83b5988fc00a621087142ab69d8fbd5b83be9d49ad322e1e234f0e

      SHA512

      6fbf1f3f107ed704d557171d7c828ec12b7f2df02628fdc8852a8b629e7d259a7f22e28015811f8a590086d1d8e1e052237fad6e73ba580bcbdbfc96e704fc51

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a931ff0eee4aa729ff84c863a2922f51

      SHA1

      0217bfca2d4c123d38466189239f76480d2efa59

      SHA256

      4762ff7a920ff68daf4358969b836f10bec29e798e4db88399d8f3b228f3cd09

      SHA512

      5a51691fe466c196aa68fa00f1a36cf1726bf93cc1883ab56db462cc155ccc872e63f7b1694bbf4d409fb1f97db648f234c2168bacff480ac42feeb7ccdcb0bc

    • C:\Users\Admin\AppData\Local\IdleMaster\IdleMaster.exe_Url_rl44rujb2jo05zekpbiugk2oe5i0unp5\1.5.0.0\user.config

      Filesize

      1KB

      MD5

      c1fcee14ee892edbead0e34b89287086

      SHA1

      33511076145303373cca2e983f1199e622303392

      SHA256

      e015b81df1553c54842f253493e66521282b91cb56d9a7ed5c2bb18bb58869a3

      SHA512

      e1d4c8be69cf8b02d4a00ae4a441e462c7c4f3c9138a79644e554595ee81df256023e1ca1ec23c605b9e10b7f5f283468ecebc2984ed6148c17fa4533c54e2a9

    • C:\Users\Admin\AppData\Local\IdleMaster\IdleMaster.exe_Url_rl44rujb2jo05zekpbiugk2oe5i0unp5\1.5.0.0\user.config

      Filesize

      815B

      MD5

      a3a9f5b2703f21c20569249015d94e78

      SHA1

      1c6e9b292a2e19b4f08a3eda556efef17d7f959e

      SHA256

      343170b3dc30f6369c4ed04ec37d37bd8b62a02d02b86011057abc64851644c7

      SHA512

      024c5cbbe1a3954f04d6103de0c549ab43aca02f135e9be71696a707d141b9af2ab04dbcd023e3b4d1fc18d1d0af9ffdac28323ee2e6c933e3a010cd9def57b5

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\home[1].htm

      Filesize

      47KB

      MD5

      5b14e9ccd0e4d51d6cded71bdfb141ce

      SHA1

      d3ee87494c749830abf0c916a021d54fc5e3edbb

      SHA256

      8e57c9c0b7e2428bfaa9e5261f8b00d6130f7b6f72b528958799717851158706

      SHA512

      af7e81db6bdaf971c68a412cc5b654ed73aef2a3452c67be221ecf72f8f04d7418526bdba61ddfdb66ddcfcb3515de15ad737fac661b5de5816aa76442936a63

    • C:\Users\Admin\AppData\Local\Temp\7zOC260ABA8\IdleMaster.exe

      Filesize

      1.8MB

      MD5

      b2ea62fe861c412083bf6698409b9cfd

      SHA1

      9187ed38aec00f0ac3293a0c0705f88b1f656d66

      SHA256

      39e35d356449abcfa18b20855dc6e65b37905b3c737e913ba8b0abbad4a8ff2a

      SHA512

      08bc26db1c2db8f5861d9b3baaa52455812634398c184bebc5c176d11c6efae46e6a4139254544cbfaf10f1bf0ba1ae2204973fd64807c5299ec77353eb93477

    • C:\Users\Admin\AppData\Local\Temp\7zOC260ABA8\error.log

      Filesize

      8KB

      MD5

      1b52318d6c81b386fc60efa4d0f280c7

      SHA1

      8b73a6cfd8af64e2782a6b0f3508ec107436bc73

      SHA256

      d3eeacdd59846b7b5151b788a47a1896ef098fac7c44110402e8947479651f19

      SHA512

      6ea6a83365a19c2041b74ccc2e12e3ded6b018b2c25421d672f672a6c14f2e549697d2c05b3c83f2a925a32594425957e2f03022fcc7fcc715dc732436dd485a

    • C:\Users\Admin\AppData\Local\Temp\7zOC26A1EB8\error.log

      Filesize

      8KB

      MD5

      92d99d5e13e1e5c7389b6f9c12ff06fa

      SHA1

      cff45c09e14d5cf760f375f170bc77205364de30

      SHA256

      099e4beffca7faaed5be16ab7f3d26daa4ebbbc2c8f4059b6f43c0e111eb2e1e

      SHA512

      6320415cfea897c5a9e9b7a616c38d6abe51ecf6fa6e4d78069f5d8cb3eb6090d8e522da440fec1d80bc258de5c40d15b2987c437885c4552703eb7de502259a

    • C:\Users\Admin\AppData\Local\Temp\Cab9C8F.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar9CB2.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • memory/912-75-0x0000000000ED0000-0x00000000010A8000-memory.dmp

      Filesize

      1.8MB

    • memory/2400-209-0x000000000C930000-0x000000000D0D6000-memory.dmp

      Filesize

      7.6MB

    • memory/2400-94-0x0000000000810000-0x00000000009E8000-memory.dmp

      Filesize

      1.8MB