Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
37s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe
Resource
win10v2004-20220812-en
General
-
Target
1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe
-
Size
102KB
-
MD5
6b0ec0eb49cc3e7847a3405be5302620
-
SHA1
07d7e33b67f569c5a8a509bd94eb6a4b83adc20a
-
SHA256
1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3
-
SHA512
84917550d459dd24737085e88972c239a6aa74075ad377c70269d43b63151b401d441a0cb4f47fcc626d3984d6c7b8dff238acda41831ac2977b920b921ec8bb
-
SSDEEP
1536:z2oWR72UygYnzuquApbYpwn0rplH5SGTKKolVPh9A0Rw3kcbKmgHj:zpWR72UygWYAeVH5z+KsV8ABlj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1716 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2028 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Loads dropped DLL 1 IoCs
pid Process 1520 1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1716 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1716 Trojan.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1716 1520 1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe 28 PID 1520 wrote to memory of 1716 1520 1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe 28 PID 1520 wrote to memory of 1716 1520 1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe 28 PID 1520 wrote to memory of 1716 1520 1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe 28 PID 1716 wrote to memory of 2028 1716 Trojan.exe 29 PID 1716 wrote to memory of 2028 1716 Trojan.exe 29 PID 1716 wrote to memory of 2028 1716 Trojan.exe 29 PID 1716 wrote to memory of 2028 1716 Trojan.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe"C:\Users\Admin\AppData\Local\Temp\1b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2028
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD56b0ec0eb49cc3e7847a3405be5302620
SHA107d7e33b67f569c5a8a509bd94eb6a4b83adc20a
SHA2561b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3
SHA51284917550d459dd24737085e88972c239a6aa74075ad377c70269d43b63151b401d441a0cb4f47fcc626d3984d6c7b8dff238acda41831ac2977b920b921ec8bb
-
Filesize
102KB
MD56b0ec0eb49cc3e7847a3405be5302620
SHA107d7e33b67f569c5a8a509bd94eb6a4b83adc20a
SHA2561b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3
SHA51284917550d459dd24737085e88972c239a6aa74075ad377c70269d43b63151b401d441a0cb4f47fcc626d3984d6c7b8dff238acda41831ac2977b920b921ec8bb
-
Filesize
102KB
MD56b0ec0eb49cc3e7847a3405be5302620
SHA107d7e33b67f569c5a8a509bd94eb6a4b83adc20a
SHA2561b53067065b9271a5848e8a51fcfcf2f6c6f4005247ec0d29f8a3b0e4c27cdf3
SHA51284917550d459dd24737085e88972c239a6aa74075ad377c70269d43b63151b401d441a0cb4f47fcc626d3984d6c7b8dff238acda41831ac2977b920b921ec8bb