Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 18:37
Static task
static1
Behavioral task
behavioral1
Sample
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
Resource
win10v2004-20220901-en
General
-
Target
ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe
-
Size
164KB
-
MD5
d84e5bbf8c16e91fec275230fa6de7a6
-
SHA1
e4855f1d90ad6f0755988bf5f090dee9f3ca403e
-
SHA256
674f447b67fa6481c04d7d4c7dc47ecc0d3956c0c7b9006c845efebbc8fb318f
-
SHA512
4c3418c993eb0e0bf27106e672d2e2ba60ad0f1cb6c8ec1f85b6c5c6459e061c755ffd05cb887e0d6eecd48212ef55832f2189f0afe7be2e72ca67f30d0c534b
-
SSDEEP
3072:ZJ/YG2oBFOU2IG7N1f0ufvLFz5+pWwW14Ih2M7XygCQJz9Jf+yY:ZJ/GoD/2VN1fpfTv+Iv14IhrzyFQt
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2044 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtntglna.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\gtntglna.exe\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1880 set thread context of 948 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 28 -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 948 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 948 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 948 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe Token: SeDebugPrivilege 1376 Explorer.EXE Token: SeShutdownPrivilege 1376 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1376 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1880 wrote to memory of 948 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 28 PID 1880 wrote to memory of 948 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 28 PID 1880 wrote to memory of 948 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 28 PID 1880 wrote to memory of 948 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 28 PID 1880 wrote to memory of 948 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 28 PID 1880 wrote to memory of 948 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 28 PID 1880 wrote to memory of 948 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 28 PID 1880 wrote to memory of 948 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 28 PID 1880 wrote to memory of 948 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 28 PID 1880 wrote to memory of 948 1880 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 28 PID 948 wrote to memory of 2044 948 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 29 PID 948 wrote to memory of 2044 948 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 29 PID 948 wrote to memory of 2044 948 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 29 PID 948 wrote to memory of 2044 948 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 29 PID 948 wrote to memory of 1376 948 ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe 17 PID 1376 wrote to memory of 1216 1376 Explorer.EXE 19 PID 1376 wrote to memory of 1216 1376 Explorer.EXE 19 PID 1376 wrote to memory of 1296 1376 Explorer.EXE 18
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exeC:\Users\Admin\AppData\Local\Temp\ihre_rechnung_11_2014_02_45_001_033_756_938923002_2210500407_3_0_5_22_29_9002_002001028.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS5967~1.BAT"4⤵
- Deletes itself
PID:2044
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1296
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1216
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201B
MD5afe094ee81fb9162944426a688c52b99
SHA14c3ef173cf5be0fbeab828a6c82311e5ae3cafcb
SHA2569751c81898f41a0f67391df71ad599b0ecd24f8a2d0c168b99e54f32ead8dc0c
SHA512ba31aa878bb298a6745be038fec68f832fabe59804a0bb61c8a43cf0dd82de26176c6b43c7c3519545b0bb9ed3c8f36a091cc900a925ccb6c90be7a0cf8ea26a