Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe
Resource
win10v2004-20220812-en
General
-
Target
0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe
-
Size
250KB
-
MD5
0abf508b51b95471c694f7a509179b19
-
SHA1
5d01020dfe6043437e93a812edc1fb49d04c0b2e
-
SHA256
0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f
-
SHA512
e3ee0d85861ddd1911d44cf7030b75119d26fdfd610ef17d6093995b994904b9e3f73ffa15e14581328c0f6b509137eb235702649542707804cfde7bff4ea06f
-
SSDEEP
6144:oxZ39gKTDKvQ3CVtlN2B3abwgADEdHhC1/pWUB/Zp35+fLA:orP6vQ3Ct328MgADEdBC/VRpJ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 112 WI5w5U21.exe 908 WI5w5U21.exe -
Deletes itself 1 IoCs
pid Process 908 WI5w5U21.exe -
Loads dropped DLL 4 IoCs
pid Process 1300 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 1300 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 1300 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 908 WI5w5U21.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\RggjZod9 = "C:\\ProgramData\\Br7FCvam\\WI5w5U21.exe" 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1720 set thread context of 1300 1720 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 27 PID 112 set thread context of 908 112 WI5w5U21.exe 29 PID 908 set thread context of 1120 908 WI5w5U21.exe 30 -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1300 1720 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 27 PID 1720 wrote to memory of 1300 1720 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 27 PID 1720 wrote to memory of 1300 1720 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 27 PID 1720 wrote to memory of 1300 1720 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 27 PID 1720 wrote to memory of 1300 1720 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 27 PID 1720 wrote to memory of 1300 1720 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 27 PID 1300 wrote to memory of 112 1300 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 28 PID 1300 wrote to memory of 112 1300 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 28 PID 1300 wrote to memory of 112 1300 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 28 PID 1300 wrote to memory of 112 1300 0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe 28 PID 112 wrote to memory of 908 112 WI5w5U21.exe 29 PID 112 wrote to memory of 908 112 WI5w5U21.exe 29 PID 112 wrote to memory of 908 112 WI5w5U21.exe 29 PID 112 wrote to memory of 908 112 WI5w5U21.exe 29 PID 112 wrote to memory of 908 112 WI5w5U21.exe 29 PID 112 wrote to memory of 908 112 WI5w5U21.exe 29 PID 908 wrote to memory of 1120 908 WI5w5U21.exe 30 PID 908 wrote to memory of 1120 908 WI5w5U21.exe 30 PID 908 wrote to memory of 1120 908 WI5w5U21.exe 30 PID 908 wrote to memory of 1120 908 WI5w5U21.exe 30 PID 908 wrote to memory of 1120 908 WI5w5U21.exe 30 PID 908 wrote to memory of 1120 908 WI5w5U21.exe 30 PID 908 wrote to memory of 1120 908 WI5w5U21.exe 30 PID 908 wrote to memory of 1120 908 WI5w5U21.exe 30 PID 908 wrote to memory of 1120 908 WI5w5U21.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe"C:\Users\Admin\AppData\Local\Temp\0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe"C:\Users\Admin\AppData\Local\Temp\0490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\ProgramData\Br7FCvam\WI5w5U21.exe"C:\ProgramData\Br7FCvam\WI5w5U21.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:112 -
C:\ProgramData\Br7FCvam\WI5w5U21.exe"C:\ProgramData\Br7FCvam\WI5w5U21.exe"4⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe" /i:9085⤵PID:1120
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250KB
MD53856902ab8404d472c99d4aab27b0573
SHA176d6175c5f01274bf79b36bf714573dcea4a13a9
SHA2560ff459c2a3d98a872133665454fee9878beff72820f0b979dadcf1c9278d6540
SHA51239ca52d5a08b06fdfb3966f9534889dd45d9711d6fed8b2d0a9a35c93d4166c9574c2c88e013c7b577a9bacc38bad2f703c07b8dd3cb0893486277bce28bc789
-
Filesize
250KB
MD53856902ab8404d472c99d4aab27b0573
SHA176d6175c5f01274bf79b36bf714573dcea4a13a9
SHA2560ff459c2a3d98a872133665454fee9878beff72820f0b979dadcf1c9278d6540
SHA51239ca52d5a08b06fdfb3966f9534889dd45d9711d6fed8b2d0a9a35c93d4166c9574c2c88e013c7b577a9bacc38bad2f703c07b8dd3cb0893486277bce28bc789
-
Filesize
250KB
MD53856902ab8404d472c99d4aab27b0573
SHA176d6175c5f01274bf79b36bf714573dcea4a13a9
SHA2560ff459c2a3d98a872133665454fee9878beff72820f0b979dadcf1c9278d6540
SHA51239ca52d5a08b06fdfb3966f9534889dd45d9711d6fed8b2d0a9a35c93d4166c9574c2c88e013c7b577a9bacc38bad2f703c07b8dd3cb0893486277bce28bc789
-
Filesize
250KB
MD53856902ab8404d472c99d4aab27b0573
SHA176d6175c5f01274bf79b36bf714573dcea4a13a9
SHA2560ff459c2a3d98a872133665454fee9878beff72820f0b979dadcf1c9278d6540
SHA51239ca52d5a08b06fdfb3966f9534889dd45d9711d6fed8b2d0a9a35c93d4166c9574c2c88e013c7b577a9bacc38bad2f703c07b8dd3cb0893486277bce28bc789
-
Filesize
250KB
MD53856902ab8404d472c99d4aab27b0573
SHA176d6175c5f01274bf79b36bf714573dcea4a13a9
SHA2560ff459c2a3d98a872133665454fee9878beff72820f0b979dadcf1c9278d6540
SHA51239ca52d5a08b06fdfb3966f9534889dd45d9711d6fed8b2d0a9a35c93d4166c9574c2c88e013c7b577a9bacc38bad2f703c07b8dd3cb0893486277bce28bc789
-
Filesize
250KB
MD50abf508b51b95471c694f7a509179b19
SHA15d01020dfe6043437e93a812edc1fb49d04c0b2e
SHA2560490dbf0a186a89514eeb9a9bf868aa8bca1ab563f96a0419709b24c00532c1f
SHA512e3ee0d85861ddd1911d44cf7030b75119d26fdfd610ef17d6093995b994904b9e3f73ffa15e14581328c0f6b509137eb235702649542707804cfde7bff4ea06f
-
Filesize
250KB
MD53856902ab8404d472c99d4aab27b0573
SHA176d6175c5f01274bf79b36bf714573dcea4a13a9
SHA2560ff459c2a3d98a872133665454fee9878beff72820f0b979dadcf1c9278d6540
SHA51239ca52d5a08b06fdfb3966f9534889dd45d9711d6fed8b2d0a9a35c93d4166c9574c2c88e013c7b577a9bacc38bad2f703c07b8dd3cb0893486277bce28bc789