Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 04:18

General

  • Target

    2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe

  • Size

    164KB

  • MD5

    744c74d17d06d1a57fde4eb674b658e5

  • SHA1

    4db6ca64d8891bea93e4fef0e54753afefe2fc1f

  • SHA256

    2c4ebda5b2fc4e138ac11f456cafc4fbdf81f557c1d27469da123a8a4bad7da4

  • SHA512

    ca43f4e7d33d1192facb320d27dfda3519b5fe8c723baa79e9e71b87a677ea75577fb8bb3ae45365207c736ec1f7273ceed12de5725ff20005f172e77538decd

  • SSDEEP

    3072:aLYWOECeWVKXdevckFFAn+jUkrKkO2oATT5o/2OWo:aLwxeSKXgckZBx3o4TWq

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
      "C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
        C:\Users\Admin\AppData\Local\Temp\2014_11_rechnung_1_1_000309399002_4884_9849_00483_00222_0039459856_29392_000000002008.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS7921~1.BAT"
          4⤵
          • Deletes itself
          PID:1528
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1232
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1152
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "-335167255-1342402528-1868656947-2094999680-4050514531668939691024914154953546764"
        1⤵
          PID:1536

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\ms7921405.bat

          Filesize

          201B

          MD5

          ae353ad80137368dcaa08c0980904fa7

          SHA1

          661fd99609e5c61a52f713f04b4bb5b1bb51db15

          SHA256

          0ecdd67265d6b65e3042946f25cd2072b8d61d32dcb72a37d8fdb30ea09070a9

          SHA512

          124479b116c6514b270713d989981b4d542733bd451101ca5d24f681996590f5fda6ef3641e37bb6123280646c7fdf9919c2b9cf280bad259de45655c952370f

        • memory/1152-87-0x0000000036F00000-0x0000000036F10000-memory.dmp

          Filesize

          64KB

        • memory/1152-92-0x0000000001C20000-0x0000000001C37000-memory.dmp

          Filesize

          92KB

        • memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

          Filesize

          8KB

        • memory/1204-65-0x00000000003C0000-0x00000000003C4000-memory.dmp

          Filesize

          16KB

        • memory/1228-60-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1228-74-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1228-56-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1228-55-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1228-67-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1228-62-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1228-63-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1228-58-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1232-86-0x0000000036F00000-0x0000000036F10000-memory.dmp

          Filesize

          64KB

        • memory/1232-93-0x0000000001AD0000-0x0000000001AE7000-memory.dmp

          Filesize

          92KB

        • memory/1288-75-0x0000000036F00000-0x0000000036F10000-memory.dmp

          Filesize

          64KB

        • memory/1288-72-0x00000000029B0000-0x00000000029C7000-memory.dmp

          Filesize

          92KB

        • memory/1288-90-0x00000000029B0000-0x00000000029C7000-memory.dmp

          Filesize

          92KB

        • memory/1528-80-0x0000000000170000-0x0000000000184000-memory.dmp

          Filesize

          80KB

        • memory/1528-89-0x0000000000190000-0x00000000001A4000-memory.dmp

          Filesize

          80KB

        • memory/1536-91-0x00000000001D0000-0x00000000001E7000-memory.dmp

          Filesize

          92KB