Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
114s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 17:02
Static task
static1
Behavioral task
behavioral1
Sample
919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe
Resource
win10v2004-20220812-en
General
-
Target
919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe
-
Size
161KB
-
MD5
8606803bf754112331a26315d8f260af
-
SHA1
e4feb2df9334a6a00d3efd0abcd1dd3d914af34b
-
SHA256
919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01
-
SHA512
3f5eda566a70926269c1644f9eb46f3a3f8a1a6aa17d5db173059366286f8b22c62d8a7959755d435d269c07868b0bb5033c2a5e0b39812b8612a15796343821
-
SSDEEP
1536:rDbr0hxBnASW9N9TgnJFyxEPikv5XmSzAEEAi2KJIaOhs+QC75lu1cEfEORv/KnS:yn5uNV+J6EJXCAi2o5Yf78fW8d
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1224 msa.exe -
resource yara_rule behavioral1/memory/1896-55-0x0000000000400000-0x000000000047A000-memory.dmp upx behavioral1/memory/1224-60-0x0000000000400000-0x000000000047A000-memory.dmp upx behavioral1/memory/1896-61-0x0000000000400000-0x000000000047A000-memory.dmp upx behavioral1/memory/1224-63-0x0000000000400000-0x000000000047A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run msa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\NordBull = "C:\\Windows\\msa.exe" msa.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job 919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe File opened for modification C:\Windows\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job 919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe File created C:\Windows\msa.exe 919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe File opened for modification C:\Windows\msa.exe 919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International msa.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1896 919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe 1224 msa.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1224 msa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1896 wrote to memory of 1224 1896 919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe 28 PID 1896 wrote to memory of 1224 1896 919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe 28 PID 1896 wrote to memory of 1224 1896 919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe 28 PID 1896 wrote to memory of 1224 1896 919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe"C:\Users\Admin\AppData\Local\Temp\919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\msa.exeC:\Windows\msa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1224
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD537973d5c8be00d095ad213211bcf0edd
SHA1aba9857d888c849760b7777f1e0d00711357ba43
SHA2561eb0e659969f91659e7d67cf0aa655c659350769de1dc31e46211c5a6e562ec4
SHA5122106f7382238d73279d7d43ac7f4ce6c97babf64103a3a13f761f7d57f831149a106aa42d75c9c4e73116d12d777075867f3288dc526947a58e1c63b9c7daf9c
-
Filesize
161KB
MD58606803bf754112331a26315d8f260af
SHA1e4feb2df9334a6a00d3efd0abcd1dd3d914af34b
SHA256919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01
SHA5123f5eda566a70926269c1644f9eb46f3a3f8a1a6aa17d5db173059366286f8b22c62d8a7959755d435d269c07868b0bb5033c2a5e0b39812b8612a15796343821
-
Filesize
161KB
MD58606803bf754112331a26315d8f260af
SHA1e4feb2df9334a6a00d3efd0abcd1dd3d914af34b
SHA256919821626c0514b2a50504cb26a287820996daaa63336522d114b326bebe7c01
SHA5123f5eda566a70926269c1644f9eb46f3a3f8a1a6aa17d5db173059366286f8b22c62d8a7959755d435d269c07868b0bb5033c2a5e0b39812b8612a15796343821