Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe
Resource
win7-20240729-en
General
-
Target
4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe
-
Size
335KB
-
MD5
8e592493f4396101c59cc31a5176b580
-
SHA1
a982d8305da273c5517f3cd35176c8146ee97bb4
-
SHA256
4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6
-
SHA512
8d7adf013194a3d1507d05956996a05f3e961816f6df800f5cf9e97499b9ee7393dd6d3d4544131eeff513cd1cc44a2cf2e024c19355090a1b48c966a99d6164
-
SSDEEP
6144:nvHWrZ+i8/iYiVst4UKVRw8pDrKlGSeNWcx1RsF9gc+XYIrY:vHW138/iXWlK885rKlGSekcj66ciy
Malware Config
Extracted
urelas
218.54.31.226
218.54.31.165
218.54.31.166
Signatures
-
Urelas family
-
Deletes itself 1 IoCs
pid Process 2824 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2696 zyfyn.exe 2492 jofub.exe -
Loads dropped DLL 2 IoCs
pid Process 1488 4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe 2696 zyfyn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zyfyn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jofub.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe 2492 jofub.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1488 wrote to memory of 2696 1488 4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe 29 PID 1488 wrote to memory of 2696 1488 4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe 29 PID 1488 wrote to memory of 2696 1488 4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe 29 PID 1488 wrote to memory of 2696 1488 4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe 29 PID 1488 wrote to memory of 2824 1488 4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe 30 PID 1488 wrote to memory of 2824 1488 4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe 30 PID 1488 wrote to memory of 2824 1488 4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe 30 PID 1488 wrote to memory of 2824 1488 4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe 30 PID 2696 wrote to memory of 2492 2696 zyfyn.exe 32 PID 2696 wrote to memory of 2492 2696 zyfyn.exe 32 PID 2696 wrote to memory of 2492 2696 zyfyn.exe 32 PID 2696 wrote to memory of 2492 2696 zyfyn.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe"C:\Users\Admin\AppData\Local\Temp\4af9cc7061bb604a8091424c394ac23aaf16e7031ecdb9048714cc89c64745d6N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\zyfyn.exe"C:\Users\Admin\AppData\Local\Temp\zyfyn.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\jofub.exe"C:\Users\Admin\AppData\Local\Temp\jofub.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2492
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD597165f500ef26497cbb33f984ff6ed11
SHA1936c9548cda4108c60f3b15f9736199e97ae0170
SHA256782352fb18b89f636c1f1664309984b1853e1a6567513e45ef4dc445e93893b3
SHA5121b30599891aa07950850a7ac7ae34316501ee6f3ea01ce0c26af443c71e8e419ba4341d80f0a74362944b1b0cfad8afba38094f543fdd1995c81241e9c061081
-
Filesize
512B
MD53a23414a505e6fd3e6d9459a52d24b37
SHA158a279715d18a0f4ced827d75fc7fabe0bcc9acb
SHA25618644c7aab53debd9e1d0dac028043fe397d7254fdff26b3babdcd9b4f3b6096
SHA51292d02f8db2be51803524576223fa64d6f77aac476431254db9bd3d170f6ec0702eca535955a8f79d4925a5ea88db836a5cb56206f171e48d832e568d5b3da138
-
Filesize
335KB
MD5689f1a670c4c1caf2f49ff9539509479
SHA114e75cb04134d7af46dec7154a46ff24ecd5e2ec
SHA25612e7cb4ff12ad752e305bcc7621460ef8206efa98f274a63405c3cefab91cbc5
SHA512e4112a946e7ec5072e272139e9f19432001774dd4084da9c7559a18c727c732800a92d74d57dc580c592fcc2ef5e3b2db00f720332a07a1823c3adeaef566578
-
Filesize
172KB
MD5452dd06c7b47d8ef60829a042e83ce77
SHA1354f980098e0863362a239cb4b4b37b2940453d8
SHA25644531bee8b78d3e85ae5c3bd02b9e9361eb7e258ebb6c0e93c5277af7aac500a
SHA512d2afe0d07c4c51d772ae45ee0fe81abea30df0908fa216db671c18ca71b9388a73a110280c2251775f5c18499059da70c52bdeffcec32731898e157f8822b184
-
Filesize
335KB
MD5898a1257cdcbf44462837890cff408e4
SHA105701035e519f463330d9e4ea1d0316d94f37777
SHA256a3cb42d583b1cf85cf078016d61ed44f02f7454381648169dfbe63dba5c58beb
SHA512b598f31921943c3b81d0b84b85bf860a960a991713e466f31a76e2df4f7f1dc84ade9b12b3912f6d0c58810277cf20674e79c6373ad3067944d4f6e181534080