Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 18:38
Static task
static1
Behavioral task
behavioral1
Sample
77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe
Resource
win10v2004-20220812-en
General
-
Target
77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe
-
Size
435KB
-
MD5
387050f87fe3ff8dbedf3c097233a710
-
SHA1
3d060c5c5065e44652a59d405ff4754bc88ba426
-
SHA256
77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc
-
SHA512
645af124b2fcfed670c00ec9ab2a53964077936c32d1df5091310eca9075dc955465257f8b23358792c031e3348a453e7b6a4f3b31d175a4d9e4b98bc785cb56
-
SSDEEP
3072:TSWVa1rLfhE9vDH8/Wg1kuWZyxOvxQggjbdRYEX+RotB5:fVa1rLhAeKuWZyxOqXjGsL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 912 sysmgr.exe -
Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: sysmgr.exe File opened (read-only) \??\F: sysmgr.exe File opened (read-only) \??\G: sysmgr.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4" sysmgr.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe sysmgr.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\conf.dat sysmgr.exe File created C:\Windows\conf.dat sysmgr.exe File created C:\Windows\sysmgr.exe 77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe File created C:\Windows\svc.dat 77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1812 wrote to memory of 912 1812 77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe 28 PID 1812 wrote to memory of 912 1812 77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe 28 PID 1812 wrote to memory of 912 1812 77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe 28 PID 1812 wrote to memory of 912 1812 77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe"C:\Users\Admin\AppData\Local\Temp\77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\sysmgr.exe"C:\Windows\sysmgr.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies WinLogon
- Drops file in Program Files directory
- Drops file in Windows directory
PID:912
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5aff9b1ba045815e945bbaac4501e194d
SHA11af9db351c56ae8aea693b946a3cb3b53e140a86
SHA25691a45c3cd09365eb09866a799d5837378b6bc302f98efebc6195fde60155ab5f
SHA5125d4abf9d16c2972a4a27b41a6b276e99b8ddf998cdfdf3f64dd766c7b76eaf334b69b29cd0a11dbc6875be59bccf26ac70124cb8524d10307a41734dd06f64d2
-
Filesize
36KB
MD52373dfbdba70b54164d4fe163f7f59f1
SHA1fbc51778f9e4868ddce4763d0bef4cb48090e3f6
SHA256e506e529d2d1d80ba433d4dec9fcbf07506112c8d0a130bed322f03346640456
SHA51232e48c596def05ddd1c987ae54cb069f750e0e4a993aa9f5c1d69e11c49ca90f6d324dfb4fa7c29c7d642eb2d939b2efe9332e0f4f4cbc5a0b2893adbf8598ec
-
Filesize
36KB
MD52373dfbdba70b54164d4fe163f7f59f1
SHA1fbc51778f9e4868ddce4763d0bef4cb48090e3f6
SHA256e506e529d2d1d80ba433d4dec9fcbf07506112c8d0a130bed322f03346640456
SHA51232e48c596def05ddd1c987ae54cb069f750e0e4a993aa9f5c1d69e11c49ca90f6d324dfb4fa7c29c7d642eb2d939b2efe9332e0f4f4cbc5a0b2893adbf8598ec