Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
65s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
11/10/2022, 20:59
General
-
Target
3fa15d4f4f18f55cc50e0ad3156e6cf6469298d7f55e79be8b229790edd736ee.exe
-
Size
430KB
-
MD5
5d2d795b97117a35974994def4082004
-
SHA1
e38ab9bbb558490b8f00e99fa03de1f9af98c918
-
SHA256
3fa15d4f4f18f55cc50e0ad3156e6cf6469298d7f55e79be8b229790edd736ee
-
SHA512
adc3abde854d302a9a6d0f93670a3d9676028451df9066c511887e61fd109bb5c65d715aabda198153863e342a83344d8951dd04dd0c4eb7d9707f451da8efbb
-
SSDEEP
6144:uoK0zat8GzwzkIXXYnPYYoK0zaaoK0zat8GzwAlrhdMwPTBoK0zaOkIs8d:vK0qjI4nA1K0OK0q2wPqK0AIt
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
-
Drops file in Drivers directory 2 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fa15d4f4f18f55cc50e0ad3156e6cf6469298d7f55e79be8b229790edd736ee.exe"C:\Users\Admin\AppData\Local\Temp\3fa15d4f4f18f55cc50e0ad3156e6cf6469298d7f55e79be8b229790edd736ee.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f2⤵
- Installs/modifies Browser Helper Object
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5d807aa04480d1d149f7a4cac22984188
SHA1ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9
SHA256eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb
SHA512875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e
-
Filesize
152KB
-
Filesize
8KB
-
Filesize
1.0MB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
1.0MB