Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
180s -
max time network
187s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21/10/2022, 05:06
Static task
static1
Behavioral task
behavioral1
Sample
dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe
Resource
win10v2004-20220812-en
General
-
Target
dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe
-
Size
80KB
-
MD5
559f24e1fa902e1f9ba079283d6f9570
-
SHA1
2bf197bb3fe0c1ae7aec5d607841df581a921ea4
-
SHA256
dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f
-
SHA512
1a55a7350eea43506c6660b982397071021fb962262ecc37fe6d8e63303fa7e6b99420ea642a53b1401abd24edf1184208b8630c0d72c3e4ace9f8d734ee62de
-
SSDEEP
1536:BxR5bM9oLiCMsJozgKWNJ4NJxPMg2o1Ej7D:BP5bphozgKWNJ4NJxPR1A7D
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\18193 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\ccrtrv.cmd" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe -
Blocklisted process makes network request 37 IoCs
flow pid Process 3 2032 msiexec.exe 4 2032 msiexec.exe 5 2032 msiexec.exe 6 2032 msiexec.exe 7 2032 msiexec.exe 8 2032 msiexec.exe 9 2032 msiexec.exe 10 2032 msiexec.exe 11 2032 msiexec.exe 12 2032 msiexec.exe 13 2032 msiexec.exe 14 2032 msiexec.exe 15 2032 msiexec.exe 16 2032 msiexec.exe 17 2032 msiexec.exe 18 2032 msiexec.exe 19 2032 msiexec.exe 20 2032 msiexec.exe 21 2032 msiexec.exe 22 2032 msiexec.exe 23 2032 msiexec.exe 24 2032 msiexec.exe 25 2032 msiexec.exe 26 2032 msiexec.exe 27 2032 msiexec.exe 28 2032 msiexec.exe 29 2032 msiexec.exe 30 2032 msiexec.exe 31 2032 msiexec.exe 32 2032 msiexec.exe 33 2032 msiexec.exe 34 2032 msiexec.exe 35 2032 msiexec.exe 36 2032 msiexec.exe 37 2032 msiexec.exe 38 2032 msiexec.exe 39 2032 msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 1072 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 996 set thread context of 1072 996 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 28 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\ccrtrv.cmd msiexec.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1072 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 1072 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 996 wrote to memory of 1072 996 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 28 PID 996 wrote to memory of 1072 996 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 28 PID 996 wrote to memory of 1072 996 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 28 PID 996 wrote to memory of 1072 996 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 28 PID 996 wrote to memory of 1072 996 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 28 PID 996 wrote to memory of 1072 996 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 28 PID 996 wrote to memory of 1072 996 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 28 PID 1072 wrote to memory of 2032 1072 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 29 PID 1072 wrote to memory of 2032 1072 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 29 PID 1072 wrote to memory of 2032 1072 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 29 PID 1072 wrote to memory of 2032 1072 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 29 PID 1072 wrote to memory of 2032 1072 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 29 PID 1072 wrote to memory of 2032 1072 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 29 PID 1072 wrote to memory of 2032 1072 dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe"C:\Users\Admin\AppData\Local\Temp\dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe"C:\Users\Admin\AppData\Local\Temp\dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\syswow64\msiexec.exeC:\Windows\syswow64\msiexec.exe3⤵
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
PID:2032
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f.exe
Filesize80KB
MD5559f24e1fa902e1f9ba079283d6f9570
SHA12bf197bb3fe0c1ae7aec5d607841df581a921ea4
SHA256dae854600603046efce5bc8e4d536a64cc80a8ee9ffa029d6d1b8a505e0c242f
SHA5121a55a7350eea43506c6660b982397071021fb962262ecc37fe6d8e63303fa7e6b99420ea642a53b1401abd24edf1184208b8630c0d72c3e4ace9f8d734ee62de