Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
241s -
max time network
352s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 04:50
Static task
static1
Behavioral task
behavioral1
Sample
2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
Resource
win10v2004-20220812-en
General
-
Target
2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe
-
Size
148KB
-
MD5
6d114c7a21aab94456d8e8d4aef88362
-
SHA1
1229f292c46ffa1bde2db69227c4e98c2e46ae3a
-
SHA256
0b577f76b08c5267eb5f2f8596127a28a6eaf5ff2089cff6be0b689f31850124
-
SHA512
828b656d5eeb4e225af9bc76fad68fd51f5bc6a867450f200e005782231cfd762ceef3d2341aa9e2dcfca9db656637dda71ee6b93083664a36e15f02a0342e03
-
SSDEEP
3072:5fSj3q4+o/mYSpVygq2xW+rQDuZz4AYOr8Hkv:xSusZSXRY+rBF4AYOr8
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1480 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\engtvbbi.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\engtvbbi.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 560 set thread context of 1868 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 28 -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 1868 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 1868 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1268 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1868 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe Token: SeDebugPrivilege 1268 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 560 wrote to memory of 1868 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 28 PID 560 wrote to memory of 1868 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 28 PID 560 wrote to memory of 1868 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 28 PID 560 wrote to memory of 1868 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 28 PID 560 wrote to memory of 1868 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 28 PID 560 wrote to memory of 1868 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 28 PID 560 wrote to memory of 1868 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 28 PID 560 wrote to memory of 1868 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 28 PID 560 wrote to memory of 1868 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 28 PID 560 wrote to memory of 1868 560 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 28 PID 1868 wrote to memory of 1480 1868 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 29 PID 1868 wrote to memory of 1480 1868 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 29 PID 1868 wrote to memory of 1480 1868 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 29 PID 1868 wrote to memory of 1480 1868 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 29 PID 1868 wrote to memory of 1268 1868 2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe 8 PID 1268 wrote to memory of 1120 1268 Explorer.EXE 10 PID 1268 wrote to memory of 1220 1268 Explorer.EXE 9 PID 1268 wrote to memory of 1480 1268 Explorer.EXE 29 PID 1268 wrote to memory of 1480 1268 Explorer.EXE 29 PID 1268 wrote to memory of 1292 1268 Explorer.EXE 30 PID 1268 wrote to memory of 1292 1268 Explorer.EXE 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe"C:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exeC:\Users\Admin\AppData\Local\Temp\2014_11details_transaktion_37900000929_november_30908300059_11_0000000039.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS2003~1.BAT"3⤵
- Deletes itself
PID:1480
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1268
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1220
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "14940505631944034461-119122327422666176-746627954-1186659599651802995481442006"1⤵PID:1292
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201B
MD531f1bad038236cdcb0de649f22b87aac
SHA1438922311d652876658c9bda983f8976bc6f0f8a
SHA256a3483616f687b358fe71c56fef0289bf3a57afc0cc007fed294092c3d32d3557
SHA512179e3a255783be0f092be81905ff827d1ece88f26aa4a4cf338c00df7a8ed5b26bfbb8ee6dae2748c717de86d6d288d2ac820eb4743ed97fa46feeb0128d453d