Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 05:28

General

  • Target

    2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe

  • Size

    148KB

  • MD5

    69a462f5962e03c6dc1d34b3ec702ef7

  • SHA1

    42a898eb901252f9839b3376e91c80eb508ecf40

  • SHA256

    7cad924cac4762e897aa2d5406cf63083e9d44d86f61cdde86946e0419746a2c

  • SHA512

    252f8baabb0f160c2886b8d781a55ac747fc443029428929e52d42974eb8bbcc362181b8813c45a91d21dde405859943dd59d148d5f4bb04a5e44e02cca9260f

  • SSDEEP

    3072:xQ/LFEPXCmqhQkGmgb6/d33HfI5NxwCshg0e4FeV3q0E:iTePXBaQkG7G5/Izbye4oVq0

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1124
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
        "C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1704
        • C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
          C:\Users\Admin\AppData\Local\Temp\2014_11rechnung_pdf_telekom_0000283882_november_00288273_11_0000000392_000005.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1664
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6137~1.BAT"
            4⤵
            • Deletes itself
            PID:772
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1212
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "-1726051269713658003-79662186919322452297571145079946339112948511-1131472448"
        1⤵
          PID:1412

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\ms6137067.bat

          Filesize

          201B

          MD5

          1b6087200c5f268c163d8f08af51f825

          SHA1

          692a5d91d3497e09f2144b4a72f891c8d164a4af

          SHA256

          246d3102295a8d33675d7440e1ca11ad9230a37f088e5fb59655a4676a0bba47

          SHA512

          f3d5e5525d778ae33f95fbeb349016c7cfd0219953873e644de18118fa4262e0f88c32f39dfcd84be68e4d83ae4f148f5161b0d46e83aeb27c886dad8f4199be

        • memory/772-82-0x0000000000080000-0x0000000000094000-memory.dmp

          Filesize

          80KB

        • memory/1124-94-0x0000000000230000-0x0000000000247000-memory.dmp

          Filesize

          92KB

        • memory/1124-84-0x0000000037100000-0x0000000037110000-memory.dmp

          Filesize

          64KB

        • memory/1212-97-0x0000000001AC0000-0x0000000001AD7000-memory.dmp

          Filesize

          92KB

        • memory/1212-96-0x0000000001AE0000-0x0000000001AF7000-memory.dmp

          Filesize

          92KB

        • memory/1212-90-0x0000000037100000-0x0000000037110000-memory.dmp

          Filesize

          64KB

        • memory/1212-88-0x0000000037100000-0x0000000037110000-memory.dmp

          Filesize

          64KB

        • memory/1248-73-0x0000000002A40000-0x0000000002A57000-memory.dmp

          Filesize

          92KB

        • memory/1248-95-0x0000000002A40000-0x0000000002A57000-memory.dmp

          Filesize

          92KB

        • memory/1248-75-0x0000000037100000-0x0000000037110000-memory.dmp

          Filesize

          64KB

        • memory/1412-91-0x0000000037100000-0x0000000037110000-memory.dmp

          Filesize

          64KB

        • memory/1412-93-0x00000000001D0000-0x00000000001E7000-memory.dmp

          Filesize

          92KB

        • memory/1664-71-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1664-67-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1664-63-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1664-62-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1664-60-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1664-58-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1664-56-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1664-55-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1704-65-0x0000000000290000-0x0000000000294000-memory.dmp

          Filesize

          16KB

        • memory/1704-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

          Filesize

          8KB