Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 18:18
Static task
static1
Behavioral task
behavioral1
Sample
5646654.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
5646654.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250129-en
General
-
Target
5646654.exe
-
Size
575KB
-
MD5
09f7f6f3e306a2909543d9ac199c7c0a
-
SHA1
3cbef0b139ee88916c063c2375b9ae4150ff4a4a
-
SHA256
dfb9d2234149f933add8bb7682094fa32430f41f34061b077776cecaa0a7ce16
-
SHA512
98d0becf921388a270d62361f772a493f83aaa9c839bfa80584ffd9307969b05147b1d309f4bd51dd86aaedafb1407e7c392ce6f8d3be53e9e5ece7064eac1de
-
SSDEEP
12288:Gk2YLS3JInQZNEjCxOV4AAm3R3W6TRVZdMN:TLKInQriCxOV4ARR1ZdM
Malware Config
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 6 IoCs
pid Process 2588 5646654.exe 2588 5646654.exe 2588 5646654.exe 2588 5646654.exe 2588 5646654.exe 2588 5646654.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\equity.Mag 5646654.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2588 5646654.exe 1884 5646654.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5646654.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5646654.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2588 5646654.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2588 wrote to memory of 1884 2588 5646654.exe 31 PID 2588 wrote to memory of 1884 2588 5646654.exe 31 PID 2588 wrote to memory of 1884 2588 5646654.exe 31 PID 2588 wrote to memory of 1884 2588 5646654.exe 31 PID 2588 wrote to memory of 1884 2588 5646654.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\5646654.exe"C:\Users\Admin\AppData\Local\Temp\5646654.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\5646654.exe"C:\Users\Admin\AppData\Local\Temp\5646654.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:1884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD52e7baf4f3c9f5830af25c66ecbe1dac4
SHA1275ee3d8faeef514ec71605788561bae14f3a48a
SHA25637346b6387f7d33a9eab62407f94cd716081eb80d7443db91b788479e6fcaf4c
SHA512a7900cc0e56998f9cd30b24584c15a8a533139cb01d16bf2046c1b1bf5ffbd67216aac69a83d1968206a99185f692bf21429622cbf53a9abbbf528ff21f7cb45
-
Filesize
5KB
MD5f1e9eed02db3a822a7ddef0c724e5f1f
SHA165864992f5b6c79c5efbefb5b1354648a8a86709
SHA2566dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df
SHA512c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5