Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/01/2025, 21:03

General

  • Target

    72d7f2c25d9368c8e60be5aea600336106be8ed587176c2d9be66ae059a700d0.exe

  • Size

    3.2MB

  • MD5

    ef95037bc2bc262ebf19f6d0e32989aa

  • SHA1

    3758acfc8f32db765d3bed155293c10e9f2d563c

  • SHA256

    72d7f2c25d9368c8e60be5aea600336106be8ed587176c2d9be66ae059a700d0

  • SHA512

    da21c049dc5f7397c32e62b03e49c72933fe9ad16c90fb85d5dc12ad5b3e5ca08068096fb8d1befdbbfb92137cea1a852f6cdecac7ab77906d6a62b28e26631b

  • SSDEEP

    49152:ZsvZqioD6MlKCXijBNt9BlXMJq7FSFG+85whW7QMt9XoayEIu3tyws:ZshoDVKCXidDDpRSFG+fhWM6CoIudBs

Malware Config

Extracted

Family

cryptbot

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

  • Cryptbot family
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 1 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\72d7f2c25d9368c8e60be5aea600336106be8ed587176c2d9be66ae059a700d0.exe
    "C:\Users\Admin\AppData\Local\Temp\72d7f2c25d9368c8e60be5aea600336106be8ed587176c2d9be66ae059a700d0.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:836
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe"
      2⤵
      • Enumerates VirtualBox registry keys
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:8076
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {96BCE679-4802-4C96-9C90-5ACD3CC16E4B} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:S4U:
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:7912
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASQBzAEYAaQB4AGUAZABTAGkAegBlAFwAVAB5AHAAZQBJAGQALgBlAHgAZQAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABJAHMARgBpAHgAZQBkAFMAaQB6AGUAXABUAHkAcABlAEkAZAAuAGUAeABlAA==
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:7944
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {613671F5-3796-4142-BB9F-DEB6FDC607CD} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Roaming\IsFixedSize\TypeId.exe
      C:\Users\Admin\AppData\Roaming\IsFixedSize\TypeId.exe
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
        3⤵
          PID:2520
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
          3⤵
            PID:8092
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
            3⤵
              PID:8132
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
              3⤵
                PID:8124
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                3⤵
                  PID:2224
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                  3⤵
                    PID:2448
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                    3⤵
                      PID:2472
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                      3⤵
                        PID:2400
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                        3⤵
                          PID:8144
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                          3⤵
                            PID:8156

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • \Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x64.exe

                        Filesize

                        628KB

                        MD5

                        ad0b3e8f6319b7fd1ead16ffe7f5be6b

                        SHA1

                        02ff5714aa418cf9a17eb9c17c0f02753746eac4

                        SHA256

                        f585688233737a15a893b0c8fb66f75bea8478e0fed11a9c72a28dd7d048ccdc

                        SHA512

                        d62c2f4a40aeed7c433b842768065b0f39496ab58e205ac008fb583e9b0018f851258ec675c8bca8cb96ced95bd568820a4bb2e9ff06c70ba7fde7b96db8f72a

                      • \Users\Admin\AppData\Local\Temp\RarSFX0\VC_redist.x86.exe

                        Filesize

                        7.7MB

                        MD5

                        f6b28de198800179a0cedaf80a94d2bf

                        SHA1

                        d4ebd56bf9f0d09763b0dc7d5744833ba0a07af3

                        SHA256

                        a93027840829eabd77e96b893e7afdabf832702fb9e95b056a45809e448fec2f

                        SHA512

                        1c8cb16058d19a4fdd323e5736a55e1aa8d41b3cd6af0012c764b67dcb9af2a2527ec9b8a08cefc2749cba93e6ffd7bc967497b431e02dc3ba822e42e2fd929a

                      • memory/572-2651-0x0000000001010000-0x00000000010B2000-memory.dmp

                        Filesize

                        648KB

                      • memory/836-37-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-51-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-15-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-17-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-77-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-75-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-73-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-69-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-67-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-65-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-63-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-61-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-57-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-31-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-53-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-33-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-49-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-47-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-45-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-41-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-39-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-12-0x0000000002710000-0x0000000002808000-memory.dmp

                        Filesize

                        992KB

                      • memory/836-13-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/836-35-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-55-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-29-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-27-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-25-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-24-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-21-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-19-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-71-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-59-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-43-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-14-0x0000000002710000-0x0000000002804000-memory.dmp

                        Filesize

                        976KB

                      • memory/836-2619-0x0000000000A30000-0x0000000000A7C000-memory.dmp

                        Filesize

                        304KB

                      • memory/836-2618-0x0000000000150000-0x00000000001A6000-memory.dmp

                        Filesize

                        344KB

                      • memory/836-2620-0x00000000011B0000-0x0000000001204000-memory.dmp

                        Filesize

                        336KB

                      • memory/836-10-0x000007FEF6053000-0x000007FEF6054000-memory.dmp

                        Filesize

                        4KB

                      • memory/836-2626-0x000007FEF6053000-0x000007FEF6054000-memory.dmp

                        Filesize

                        4KB

                      • memory/836-11-0x0000000001260000-0x0000000001302000-memory.dmp

                        Filesize

                        648KB

                      • memory/836-2628-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/836-2631-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/7944-2627-0x0000000001650000-0x0000000001658000-memory.dmp

                        Filesize

                        32KB

                      • memory/7944-2625-0x0000000019F90000-0x000000001A272000-memory.dmp

                        Filesize

                        2.9MB