Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
01/12/2022, 21:52
General
-
Target
862676349857d84a9bbc632ea3ba2d2b8b5e8eb7147c3682a6b6f47148a7a0de.exe
-
Size
282KB
-
MD5
6067f017775e65f1ddca50b2c607bf0d
-
SHA1
ef3b95e282fee497172998f05132204abd4e9fb5
-
SHA256
862676349857d84a9bbc632ea3ba2d2b8b5e8eb7147c3682a6b6f47148a7a0de
-
SHA512
f3951d29535d12ba0dec9b6465562a714125eefafb1b18a4c6d13415e0d67608e81e1662d05f4661adba35b1949219e708abf27b353a09f2e056ecfd12d98a65
-
SSDEEP
6144:yZdSBtBGvMjrFpttK0FPS/bAcFE6ZqkFbF70LVPVZ9s:YZvMl7Y01kAce6n6VPV4
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\862676349857d84a9bbc632ea3ba2d2b8b5e8eb7147c3682a6b6f47148a7a0de.exe"C:\Users\Admin\AppData\Local\Temp\862676349857d84a9bbc632ea3ba2d2b8b5e8eb7147c3682a6b6f47148a7a0de.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\862676349857d84a9bbc632ea3ba2d2b8b5e8eb7147c3682a6b6f47148a7a0de.exeC:\Users\Admin\AppData\Local\Temp\862676349857d84a9bbc632ea3ba2d2b8b5e8eb7147c3682a6b6f47148a7a0de.exe startC:\Users\Admin\AppData\Roaming\0F8F6\90638.exe%C:\Users\Admin\AppData\Roaming\0F8F62⤵
-
-
C:\Program Files (x86)\LP\3800\86DD.tmp"C:\Program Files (x86)\LP\3800\86DD.tmp"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\862676349857d84a9bbc632ea3ba2d2b8b5e8eb7147c3682a6b6f47148a7a0de.exeC:\Users\Admin\AppData\Local\Temp\862676349857d84a9bbc632ea3ba2d2b8b5e8eb7147c3682a6b6f47148a7a0de.exe startC:\Program Files (x86)\F6ABD\lvvm.exe%C:\Program Files (x86)\F6ABD2⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5581⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD550777c38a35804872660aa71c7eb52d2
SHA1c94bdd4378d0e9f0bb2a71edca520bd49251a7aa
SHA25644761b2153a01f2cd930d6b87fc3e2ba09e8940e4d096b556e99c74f26938faa
SHA5120beaa0e126af6adab4867e40fbfe554b829a769bd22af5aad1cfe5f63d569c16c2a003d7b98724efdf8fe255b6c8b124487c999db70c2012ba68faa130fa9ce4
-
Filesize
100KB
MD550777c38a35804872660aa71c7eb52d2
SHA1c94bdd4378d0e9f0bb2a71edca520bd49251a7aa
SHA25644761b2153a01f2cd930d6b87fc3e2ba09e8940e4d096b556e99c74f26938faa
SHA5120beaa0e126af6adab4867e40fbfe554b829a769bd22af5aad1cfe5f63d569c16c2a003d7b98724efdf8fe255b6c8b124487c999db70c2012ba68faa130fa9ce4
-
Filesize
100KB
MD550777c38a35804872660aa71c7eb52d2
SHA1c94bdd4378d0e9f0bb2a71edca520bd49251a7aa
SHA25644761b2153a01f2cd930d6b87fc3e2ba09e8940e4d096b556e99c74f26938faa
SHA5120beaa0e126af6adab4867e40fbfe554b829a769bd22af5aad1cfe5f63d569c16c2a003d7b98724efdf8fe255b6c8b124487c999db70c2012ba68faa130fa9ce4
-
Filesize
132KB
-
Filesize
424KB
-
Filesize
8KB
-
Filesize
424KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
424KB
-
Filesize
8KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
132KB
-
Filesize
424KB