Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 11:06
Static task
static1
Behavioral task
behavioral1
Sample
2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe
Resource
win10v2004-20220812-en
General
-
Target
2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe
-
Size
166KB
-
MD5
bf45f27a403acfd3847fbbae88a8375f
-
SHA1
06bd4a8895b0dd88a04e7de03e3f1f362e33d518
-
SHA256
2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2
-
SHA512
d851d35fd317fd1dfaf7deb6c5e2530af38976271d859cc81532bd9e7c766fccbb24ca0063c3336be29597617da96e92a6da688e4c26c4f17294f8ce45cb42c0
-
SSDEEP
3072:4cNLL5QPHSlkC0y3fOl0W7nbiCIiptMm7SmAXNzSrCdIfUEyPnmVhOQVEX4:4cNLLyvSlWy3e7nVjtMInGCsE2YkQV
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 276 enzo.exe 1912 enzo.exe -
Deletes itself 1 IoCs
pid Process 1316 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1124 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 1124 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\{36A93B24-359E-DDCC-CB48-1B6F010CA53A} = "C:\\Users\\Admin\\AppData\\Roaming\\Leafwi\\enzo.exe" enzo.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\Currentversion\Run enzo.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1700 set thread context of 1124 1700 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 28 PID 276 set thread context of 1912 276 enzo.exe 30 -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe 1912 enzo.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 1124 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1124 1700 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 28 PID 1700 wrote to memory of 1124 1700 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 28 PID 1700 wrote to memory of 1124 1700 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 28 PID 1700 wrote to memory of 1124 1700 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 28 PID 1700 wrote to memory of 1124 1700 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 28 PID 1700 wrote to memory of 1124 1700 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 28 PID 1700 wrote to memory of 1124 1700 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 28 PID 1700 wrote to memory of 1124 1700 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 28 PID 1700 wrote to memory of 1124 1700 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 28 PID 1124 wrote to memory of 276 1124 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 29 PID 1124 wrote to memory of 276 1124 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 29 PID 1124 wrote to memory of 276 1124 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 29 PID 1124 wrote to memory of 276 1124 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 29 PID 276 wrote to memory of 1912 276 enzo.exe 30 PID 276 wrote to memory of 1912 276 enzo.exe 30 PID 276 wrote to memory of 1912 276 enzo.exe 30 PID 276 wrote to memory of 1912 276 enzo.exe 30 PID 276 wrote to memory of 1912 276 enzo.exe 30 PID 276 wrote to memory of 1912 276 enzo.exe 30 PID 276 wrote to memory of 1912 276 enzo.exe 30 PID 276 wrote to memory of 1912 276 enzo.exe 30 PID 276 wrote to memory of 1912 276 enzo.exe 30 PID 1124 wrote to memory of 1316 1124 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 31 PID 1124 wrote to memory of 1316 1124 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 31 PID 1124 wrote to memory of 1316 1124 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 31 PID 1124 wrote to memory of 1316 1124 2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe 31 PID 1912 wrote to memory of 1112 1912 enzo.exe 18 PID 1912 wrote to memory of 1112 1912 enzo.exe 18 PID 1912 wrote to memory of 1112 1912 enzo.exe 18 PID 1912 wrote to memory of 1112 1912 enzo.exe 18 PID 1912 wrote to memory of 1112 1912 enzo.exe 18 PID 1912 wrote to memory of 1180 1912 enzo.exe 17 PID 1912 wrote to memory of 1180 1912 enzo.exe 17 PID 1912 wrote to memory of 1180 1912 enzo.exe 17 PID 1912 wrote to memory of 1180 1912 enzo.exe 17 PID 1912 wrote to memory of 1180 1912 enzo.exe 17 PID 1912 wrote to memory of 1208 1912 enzo.exe 16 PID 1912 wrote to memory of 1208 1912 enzo.exe 16 PID 1912 wrote to memory of 1208 1912 enzo.exe 16 PID 1912 wrote to memory of 1208 1912 enzo.exe 16 PID 1912 wrote to memory of 1208 1912 enzo.exe 16 PID 1912 wrote to memory of 284 1912 enzo.exe 33 PID 1912 wrote to memory of 284 1912 enzo.exe 33 PID 1912 wrote to memory of 284 1912 enzo.exe 33 PID 1912 wrote to memory of 284 1912 enzo.exe 33 PID 1912 wrote to memory of 284 1912 enzo.exe 33 PID 1912 wrote to memory of 1696 1912 enzo.exe 34 PID 1912 wrote to memory of 1696 1912 enzo.exe 34 PID 1912 wrote to memory of 1696 1912 enzo.exe 34 PID 1912 wrote to memory of 1696 1912 enzo.exe 34 PID 1912 wrote to memory of 1696 1912 enzo.exe 34
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe"C:\Users\Admin\AppData\Local\Temp\2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\users\admin\appdata\local\temp\2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe"c:\users\admin\appdata\local\temp\2a78722fd24eab24791ebe36ea286bb9f00fa1d0edebed2f6c72ab1396e0c5d2.exe"3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Roaming\Leafwi\enzo.exe"C:\Users\Admin\AppData\Roaming\Leafwi\enzo.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\users\admin\appdata\roaming\leafwi\enzo.exe"c:\users\admin\appdata\roaming\leafwi\enzo.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1912
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb29381d4.bat"4⤵
- Deletes itself
PID:1316
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:284
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1696
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD57ea525382c2497e2fa92f4bfc2f77bae
SHA1f14527984805839ed58104731e369532e167be0b
SHA256828f48e58c3acce7d7ebb77c08fd8820733cae8d414c37d0dbdb44b158053a0d
SHA5128ec16dc11143a7cf75d656a093713c45cc44e9d275134cd0644a7980a20c7d40edca03786b8a9cd8c066faca2ff657d29e02ade511f07b986144e1c1d8a5a4b1
-
Filesize
166KB
MD598a6e43ed34b09ca03e126ced6d7fe4f
SHA156b76ef210142b024e2d03d2b610f3a3d408d637
SHA256abb4a50678dabfefa4f22f247884a80bc07c8346d2fc8f07dd6d5080507e3088
SHA512a53e1bc1e0856f59ee11ee0bfddf9be9216ae747d31f4b5392f10062c5890ae69ebf4ed92b893790fdf7b33e1efe82335082191b4bfd73c03432e405b6b3394f
-
Filesize
166KB
MD598a6e43ed34b09ca03e126ced6d7fe4f
SHA156b76ef210142b024e2d03d2b610f3a3d408d637
SHA256abb4a50678dabfefa4f22f247884a80bc07c8346d2fc8f07dd6d5080507e3088
SHA512a53e1bc1e0856f59ee11ee0bfddf9be9216ae747d31f4b5392f10062c5890ae69ebf4ed92b893790fdf7b33e1efe82335082191b4bfd73c03432e405b6b3394f
-
Filesize
166KB
MD598a6e43ed34b09ca03e126ced6d7fe4f
SHA156b76ef210142b024e2d03d2b610f3a3d408d637
SHA256abb4a50678dabfefa4f22f247884a80bc07c8346d2fc8f07dd6d5080507e3088
SHA512a53e1bc1e0856f59ee11ee0bfddf9be9216ae747d31f4b5392f10062c5890ae69ebf4ed92b893790fdf7b33e1efe82335082191b4bfd73c03432e405b6b3394f
-
Filesize
166KB
MD598a6e43ed34b09ca03e126ced6d7fe4f
SHA156b76ef210142b024e2d03d2b610f3a3d408d637
SHA256abb4a50678dabfefa4f22f247884a80bc07c8346d2fc8f07dd6d5080507e3088
SHA512a53e1bc1e0856f59ee11ee0bfddf9be9216ae747d31f4b5392f10062c5890ae69ebf4ed92b893790fdf7b33e1efe82335082191b4bfd73c03432e405b6b3394f
-
Filesize
166KB
MD598a6e43ed34b09ca03e126ced6d7fe4f
SHA156b76ef210142b024e2d03d2b610f3a3d408d637
SHA256abb4a50678dabfefa4f22f247884a80bc07c8346d2fc8f07dd6d5080507e3088
SHA512a53e1bc1e0856f59ee11ee0bfddf9be9216ae747d31f4b5392f10062c5890ae69ebf4ed92b893790fdf7b33e1efe82335082191b4bfd73c03432e405b6b3394f