Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 05:16

General

  • Target

    3ac9e67360ec258e374581b9e60d3e82f59b29fcefc58edf8877f14f996416ae.exe

  • Size

    932KB

  • MD5

    9390a7a07408c32c5996f5ed706c2fb8

  • SHA1

    0e234904d75e4d432199426bbc812bb55253a540

  • SHA256

    3ac9e67360ec258e374581b9e60d3e82f59b29fcefc58edf8877f14f996416ae

  • SHA512

    9b509242a6ea2a00ac8b8462bb0fc1862e75be805651674ad1be09d6b38a3cf4f486246be10034936c2cc69ff8f7b7e28decdeafc4c819fbdd5b92cd58f21ec3

  • SSDEEP

    3072:yvxRc7U/tY6nCyILZ7TNlPgYGIqMWWAo2U8uCGGmj/h8RwmoCGOs7hem7TDXL7iX:yyPfMNRPlM0Q1hU

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ac9e67360ec258e374581b9e60d3e82f59b29fcefc58edf8877f14f996416ae.exe
    "C:\Users\Admin\AppData\Local\Temp\3ac9e67360ec258e374581b9e60d3e82f59b29fcefc58edf8877f14f996416ae.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\3ac9e67360ec258e374581b9e60d3e82f59b29fcefc58edf8877f14f996416ae.exe
      "C:\Users\Admin\AppData\Local\Temp\3ac9e67360ec258e374581b9e60d3e82f59b29fcefc58edf8877f14f996416ae.exe"
      2⤵
      • Modifies firewall policy service
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram 1.exe 1 ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:552
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram 1.exe 1 ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:1536
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          PID:1144

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\svchost.exe

    Filesize

    932KB

    MD5

    9390a7a07408c32c5996f5ed706c2fb8

    SHA1

    0e234904d75e4d432199426bbc812bb55253a540

    SHA256

    3ac9e67360ec258e374581b9e60d3e82f59b29fcefc58edf8877f14f996416ae

    SHA512

    9b509242a6ea2a00ac8b8462bb0fc1862e75be805651674ad1be09d6b38a3cf4f486246be10034936c2cc69ff8f7b7e28decdeafc4c819fbdd5b92cd58f21ec3

  • C:\Users\Admin\AppData\Roaming\svchost.exe

    Filesize

    932KB

    MD5

    9390a7a07408c32c5996f5ed706c2fb8

    SHA1

    0e234904d75e4d432199426bbc812bb55253a540

    SHA256

    3ac9e67360ec258e374581b9e60d3e82f59b29fcefc58edf8877f14f996416ae

    SHA512

    9b509242a6ea2a00ac8b8462bb0fc1862e75be805651674ad1be09d6b38a3cf4f486246be10034936c2cc69ff8f7b7e28decdeafc4c819fbdd5b92cd58f21ec3

  • C:\Users\Admin\AppData\Roaming\svchost.exe

    Filesize

    932KB

    MD5

    9390a7a07408c32c5996f5ed706c2fb8

    SHA1

    0e234904d75e4d432199426bbc812bb55253a540

    SHA256

    3ac9e67360ec258e374581b9e60d3e82f59b29fcefc58edf8877f14f996416ae

    SHA512

    9b509242a6ea2a00ac8b8462bb0fc1862e75be805651674ad1be09d6b38a3cf4f486246be10034936c2cc69ff8f7b7e28decdeafc4c819fbdd5b92cd58f21ec3

  • \Users\Admin\AppData\Roaming\svchost.exe

    Filesize

    932KB

    MD5

    9390a7a07408c32c5996f5ed706c2fb8

    SHA1

    0e234904d75e4d432199426bbc812bb55253a540

    SHA256

    3ac9e67360ec258e374581b9e60d3e82f59b29fcefc58edf8877f14f996416ae

    SHA512

    9b509242a6ea2a00ac8b8462bb0fc1862e75be805651674ad1be09d6b38a3cf4f486246be10034936c2cc69ff8f7b7e28decdeafc4c819fbdd5b92cd58f21ec3

  • \Users\Admin\AppData\Roaming\svchost.exe

    Filesize

    932KB

    MD5

    9390a7a07408c32c5996f5ed706c2fb8

    SHA1

    0e234904d75e4d432199426bbc812bb55253a540

    SHA256

    3ac9e67360ec258e374581b9e60d3e82f59b29fcefc58edf8877f14f996416ae

    SHA512

    9b509242a6ea2a00ac8b8462bb0fc1862e75be805651674ad1be09d6b38a3cf4f486246be10034936c2cc69ff8f7b7e28decdeafc4c819fbdd5b92cd58f21ec3

  • memory/1776-56-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1776-61-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1776-60-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/1776-59-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

    Filesize

    8KB

  • memory/1776-77-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB