Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 03:20
Static task
static1
Behavioral task
behavioral1
Sample
4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe
Resource
win10v2004-20220812-en
General
-
Target
4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe
-
Size
146KB
-
MD5
699bc8f2ec4086a8423dc35a8eb200c1
-
SHA1
6619f7681b1a1d5e253fae153a3beb4563e3ca1f
-
SHA256
4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff
-
SHA512
88a930dea56d5443610cdf1772db2d1675c533a9bbd3b4252ca82eb92062b177a36f82e4cc0918eb7f6e55b81a2559d718e8eaad82e021e10cf3607c3d5cdb96
-
SSDEEP
3072:x39yt/7RuBR9TYASYDdZwXB6YHKd2//wj6w68SwRoHbJrnULEmhHXkJc3ki4e9:x39yt/7RuBR9TYASYLGoYHKds/CQwKHw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 672 Vnabea.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job 4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe File opened for modification C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job 4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe File created C:\Windows\Vnabea.exe 4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe File opened for modification C:\Windows\Vnabea.exe 4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe File created C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job Vnabea.exe File opened for modification C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job Vnabea.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main Vnabea.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\International Vnabea.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe 672 Vnabea.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1460 4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe 672 Vnabea.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 672 1460 4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe 27 PID 1460 wrote to memory of 672 1460 4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe 27 PID 1460 wrote to memory of 672 1460 4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe 27 PID 1460 wrote to memory of 672 1460 4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe"C:\Users\Admin\AppData\Local\Temp\4999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\Vnabea.exeC:\Windows\Vnabea.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:672
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD51cf0ee5fdd2cd53aeec17a13293a4f7d
SHA15115caf3f2e29bceefb0b3dfe9690b6485d2cf96
SHA256c2fa8f6b006696f6e19ecc9079e1430a1595440a80fe47349919ad1223e0678d
SHA5127b3260bb8792a37d9edcc911887c5c74bbabb06a480ee49621f3f24b5f69a5712ce3c2d2693bb691bb7c6a81ef753fd0e2094a5cd2a3fad0d34bc9524a221ade
-
Filesize
146KB
MD5699bc8f2ec4086a8423dc35a8eb200c1
SHA16619f7681b1a1d5e253fae153a3beb4563e3ca1f
SHA2564999399c0d67a27e00ce2bede0d85bbe22156faed685f3183d60968b21f838ff
SHA51288a930dea56d5443610cdf1772db2d1675c533a9bbd3b4252ca82eb92062b177a36f82e4cc0918eb7f6e55b81a2559d718e8eaad82e021e10cf3607c3d5cdb96