Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 05:29
Static task
static1
Behavioral task
behavioral1
Sample
0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe
Resource
win7-20220812-en
General
-
Target
0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe
-
Size
151KB
-
MD5
24fb53bb124ac23482579b1b5521431d
-
SHA1
f167cccc73fc1247c2be0454e8028f69545afe56
-
SHA256
0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf
-
SHA512
9e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96
-
SSDEEP
3072:7p596Yn5D72slWD6m39g5Qb+LNoOslm3LVNquOVVlvwp1eh8lSwgsout:F596+RfWD64+LNoDg3x7Uwqh8lSwzoS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1520 msservice32.exe -
Deletes itself 1 IoCs
pid Process 1520 msservice32.exe -
Loads dropped DLL 2 IoCs
pid Process 892 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe 892 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\msservice32.exe 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe File opened for modification C:\Windows\SysWOW64\msservice32.exe 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe File opened for modification C:\Windows\SysWOW64\msservice32.exe msservice32.exe File created C:\Windows\SysWOW64\msservice32.exe msservice32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 892 wrote to memory of 1520 892 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe 27 PID 892 wrote to memory of 1520 892 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe 27 PID 892 wrote to memory of 1520 892 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe 27 PID 892 wrote to memory of 1520 892 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe 27 PID 1520 wrote to memory of 2032 1520 msservice32.exe 28 PID 1520 wrote to memory of 2032 1520 msservice32.exe 28 PID 1520 wrote to memory of 2032 1520 msservice32.exe 28 PID 1520 wrote to memory of 2032 1520 msservice32.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe"C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\msservice32.exeC:\Windows\system32\msservice32.exe 544 "C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat C:\Windows\SysWOW64\msservice32.exe3⤵PID:2032
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136B
MD5bfcf9cc6d1c37953dfa43312e2c36140
SHA107a4c0f29b282c34be24c312c4b920e479f4cee0
SHA256bac7cce52aeba3a2e2ce2bb6aebf50ffa65530d0d51ca49a2abc7f4e43ce3ce5
SHA512fb661474557e7168d4050607863b57649fa12a26ab9bd06078ae3254d003d76cfed4eac3d0a78a56eaf0ecc5b231d52788b6c8688cb14b0c86a37efe90f5f53a
-
Filesize
140B
MD566592a3bacbb2eff53b68c9a855e1415
SHA12d8af06f3bd14f1c4385844ed775ecedc359f956
SHA2562efd510d0038b58198efda885cad58ec2a1dc9345b354572f54ad41ce521b277
SHA512ebb22c7d3e1e30dfc26b55fda6abfa9df0973751ac43e396244e6697142f74f5a1117d7e7f24cb4d4c02ce369c4c21091876a0cb9ace86a2b6590b023b89bd4c
-
Filesize
151KB
MD524fb53bb124ac23482579b1b5521431d
SHA1f167cccc73fc1247c2be0454e8028f69545afe56
SHA2560795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf
SHA5129e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96
-
Filesize
151KB
MD524fb53bb124ac23482579b1b5521431d
SHA1f167cccc73fc1247c2be0454e8028f69545afe56
SHA2560795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf
SHA5129e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96
-
Filesize
151KB
MD524fb53bb124ac23482579b1b5521431d
SHA1f167cccc73fc1247c2be0454e8028f69545afe56
SHA2560795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf
SHA5129e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96
-
Filesize
151KB
MD524fb53bb124ac23482579b1b5521431d
SHA1f167cccc73fc1247c2be0454e8028f69545afe56
SHA2560795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf
SHA5129e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96