Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

de_0000239...98.exe

windows7-x64

7

de_0000239...98.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    28/11/2022, 03:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe

  • Size

    148KB

  • MD5

    cf8a95fdfdac0838c986c0bf0d3e0644

  • SHA1

    dfb8489d7fa3486e89af729eb60241e7611b1b92

  • SHA256

    caa59a2cbbfed250b7f776e36907a17710c12cdcf2bd8a04ec7a4f3be8125e29

  • SHA512

    7739e52ec9eb778664cf151e16d5b29496ed875431cd3cf4b6924dba992d280dc1769a38ecf63c4601a24a3e0460629afce64611427cd9b90b45a436bdc58aae

  • SSDEEP

    3072:ssKHHVQIy7lIK08RVIizYafDikD1a9InMv90VG3F:7KKAK08RVL0+DiGhnMFyG3

Score
7/10
persistence

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
      "C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
        C:\Users\Admin\AppData\Local\Temp\de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1240
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS5967~1.BAT"
          4⤵
          • Deletes itself
          PID:580
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1180
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1112

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\ms5967899.bat
        Filesize

        201B

        MD5

        eb474d74e12dabe0ce2193ac839aa905

        SHA1

        2582e1c077bdc8f695f9c39a6e09d4bee025a743

        SHA256

        48899bd558087654d5904a1f57778502afb3c4eedff2f5fd864b6e0de0baf80c

        SHA512

        64f2b781069a7cc0c13a3b11fe212a9f8a653cbe721a8b7cb69618425674b2e91474837c5a3a228922e78d1034502e614102ff3611ef3bcffa7e968d82b05c34

        Download Submit

      • memory/1112-83-0x0000000037C30000-0x0000000037C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1112-84-0x0000000001BC0000-0x0000000001BD7000-memory.dmp

        Filesize

        92KB

        Download

      • memory/1180-86-0x0000000001AC0000-0x0000000001AD7000-memory.dmp

        Filesize

        92KB

        Download

      • memory/1180-82-0x0000000037C30000-0x0000000037C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1208-72-0x00000000025E0000-0x00000000025F7000-memory.dmp

        Filesize

        92KB

        Download

      • memory/1208-87-0x00000000025E0000-0x00000000025F7000-memory.dmp

        Filesize

        92KB

        Download

      • memory/1208-85-0x00000000025E0000-0x00000000025F7000-memory.dmp

        Filesize

        92KB

        Download

      • memory/1208-75-0x0000000037C30000-0x0000000037C40000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1240-63-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1240-56-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1240-74-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1240-67-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1240-55-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1240-58-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1240-62-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1240-60-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1700-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1700-65-0x0000000000380000-0x0000000000384000-memory.dmp

        Filesize

        16KB

        Download