Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 00:54

General

  • Target

    9d2d6ef6df099886cd84fd93c8435fec9d6fa2f7defa268c628e242607a5359c.exe

  • Size

    268KB

  • MD5

    67d9f43089bc69eb3e03986fda89d1d3

  • SHA1

    609ba5b9364e46da45a6e99c867d40fcdde91437

  • SHA256

    9d2d6ef6df099886cd84fd93c8435fec9d6fa2f7defa268c628e242607a5359c

  • SHA512

    a0e923f0a90b290857424278ea0d6ea8b7aeb7333d57fb2d0d9932b9a33b8b92665d199f2e5c3bcbefb1ad1faefb7553d5c119481cf3cc955776ea9892c8fad5

  • SSDEEP

    3072:xfMMrxVbx6nbisl39zCWbxcKojHpReFAlqDZO42ivVWCHvRZLk2om+X0s5q6:5EisVpCWbxipRa4q44mm5z+X0kq

Malware Config

Signatures

  • Stops running service(s) 3 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d2d6ef6df099886cd84fd93c8435fec9d6fa2f7defa268c628e242607a5359c.exe
    "C:\Users\Admin\AppData\Local\Temp\9d2d6ef6df099886cd84fd93c8435fec9d6fa2f7defa268c628e242607a5359c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:892
    • C:\Windows\SysWOW64\sc.exe
      sc stop sharedaccess
      2⤵
      • Launches sc.exe
      PID:1760

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/892-54-0x0000000075141000-0x0000000075143000-memory.dmp

    Filesize

    8KB

  • memory/892-55-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/892-56-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/892-57-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB