Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
24/11/2022, 00:33
General
-
Target
e233a24ce8ae4b40a6886f53b00a9a973f076be212443be0d090d0a8d25a0107.exe
-
Size
240KB
-
MD5
35b4cdae7e5ce5e6e85043974a2a2565
-
SHA1
e7111d730cc3e2bd576139a1b8d73408e55212cf
-
SHA256
e233a24ce8ae4b40a6886f53b00a9a973f076be212443be0d090d0a8d25a0107
-
SHA512
3aad831de935dcf2083b3f2fceee8f622961aa6000397954b404484cf511da7c02e3e459befa2825b282f6781c39375ae58aad30e9f0b14ca785996d80046a21
-
SSDEEP
3072:TNf3wRqQxKvxnsRcaCL+1TwiHOgk1pHpPZkUjWVzplL9a6OSwTukdDXkxe86K:pPeyxTQOgIPZk1VzplL9a6FwTBdD6L6K
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e233a24ce8ae4b40a6886f53b00a9a973f076be212443be0d090d0a8d25a0107.exe"C:\Users\Admin\AppData\Local\Temp\e233a24ce8ae4b40a6886f53b00a9a973f076be212443be0d090d0a8d25a0107.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD51f5008049a65015c2838acb64cbd2e96
SHA1fe5ee32fbe536fb86f2a6ade047c5bc4b24f9f1c
SHA2561b9275491e7a4fc5a2c846c28df15d3d88a649fd8892017359c07e6f5c9919ea
SHA512511ee68ce8c603e739cb90f645925afd1a4d2cc0a7e646d59a95810a429b63be509e35bbadfc836090c1a80d72eb3443317a66b13191a0b847a910656f876784
-
Filesize
151KB
MD51f5008049a65015c2838acb64cbd2e96
SHA1fe5ee32fbe536fb86f2a6ade047c5bc4b24f9f1c
SHA2561b9275491e7a4fc5a2c846c28df15d3d88a649fd8892017359c07e6f5c9919ea
SHA512511ee68ce8c603e739cb90f645925afd1a4d2cc0a7e646d59a95810a429b63be509e35bbadfc836090c1a80d72eb3443317a66b13191a0b847a910656f876784
-
Filesize
151KB
MD51f5008049a65015c2838acb64cbd2e96
SHA1fe5ee32fbe536fb86f2a6ade047c5bc4b24f9f1c
SHA2561b9275491e7a4fc5a2c846c28df15d3d88a649fd8892017359c07e6f5c9919ea
SHA512511ee68ce8c603e739cb90f645925afd1a4d2cc0a7e646d59a95810a429b63be509e35bbadfc836090c1a80d72eb3443317a66b13191a0b847a910656f876784
-
Filesize
151KB
MD51f5008049a65015c2838acb64cbd2e96
SHA1fe5ee32fbe536fb86f2a6ade047c5bc4b24f9f1c
SHA2561b9275491e7a4fc5a2c846c28df15d3d88a649fd8892017359c07e6f5c9919ea
SHA512511ee68ce8c603e739cb90f645925afd1a4d2cc0a7e646d59a95810a429b63be509e35bbadfc836090c1a80d72eb3443317a66b13191a0b847a910656f876784
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
Filesize
88KB
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
24KB