Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982.exe
Resource
win10v2004-20220812-en
General
-
Target
2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982.exe
-
Size
246KB
-
MD5
4e606d760a245691f70c46259d5e01f0
-
SHA1
45453c475d44b1333b6770a9d7318bb5f8c27113
-
SHA256
2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982
-
SHA512
ad7d06034310736d827f39a8c97467b1ced27dc337ac3d8c069971f565c199c5ac0cfc56ff2efdf868d1c1a53c05437e8565345c57ed70811e39d14ab1cd267a
-
SSDEEP
6144:rdqFZbqg773/n3lrcGSglDXn9yi3krkieL5KsovDHdTzqudBDo2NrvJy65eW1CXW:omc3lrcGSglDXn9DIBTH1Gf8Gpq9Tbl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 760 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1504 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Loads dropped DLL 2 IoCs
pid Process 620 2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982.exe 620 2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 760 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 760 Trojan.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 620 wrote to memory of 760 620 2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982.exe 27 PID 620 wrote to memory of 760 620 2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982.exe 27 PID 620 wrote to memory of 760 620 2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982.exe 27 PID 620 wrote to memory of 760 620 2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982.exe 27 PID 760 wrote to memory of 1504 760 Trojan.exe 28 PID 760 wrote to memory of 1504 760 Trojan.exe 28 PID 760 wrote to memory of 1504 760 Trojan.exe 28 PID 760 wrote to memory of 1504 760 Trojan.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982.exe"C:\Users\Admin\AppData\Local\Temp\2e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1504
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
246KB
MD54e606d760a245691f70c46259d5e01f0
SHA145453c475d44b1333b6770a9d7318bb5f8c27113
SHA2562e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982
SHA512ad7d06034310736d827f39a8c97467b1ced27dc337ac3d8c069971f565c199c5ac0cfc56ff2efdf868d1c1a53c05437e8565345c57ed70811e39d14ab1cd267a
-
Filesize
246KB
MD54e606d760a245691f70c46259d5e01f0
SHA145453c475d44b1333b6770a9d7318bb5f8c27113
SHA2562e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982
SHA512ad7d06034310736d827f39a8c97467b1ced27dc337ac3d8c069971f565c199c5ac0cfc56ff2efdf868d1c1a53c05437e8565345c57ed70811e39d14ab1cd267a
-
Filesize
246KB
MD54e606d760a245691f70c46259d5e01f0
SHA145453c475d44b1333b6770a9d7318bb5f8c27113
SHA2562e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982
SHA512ad7d06034310736d827f39a8c97467b1ced27dc337ac3d8c069971f565c199c5ac0cfc56ff2efdf868d1c1a53c05437e8565345c57ed70811e39d14ab1cd267a
-
Filesize
246KB
MD54e606d760a245691f70c46259d5e01f0
SHA145453c475d44b1333b6770a9d7318bb5f8c27113
SHA2562e3f45822cf7b43f768af036fa247459992d77af618a9e9b62642f4c304a8982
SHA512ad7d06034310736d827f39a8c97467b1ced27dc337ac3d8c069971f565c199c5ac0cfc56ff2efdf868d1c1a53c05437e8565345c57ed70811e39d14ab1cd267a