Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
196s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 02:41
Static task
static1
Behavioral task
behavioral1
Sample
7b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861.exe
Resource
win10v2004-20221111-en
General
-
Target
7b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861.exe
-
Size
43KB
-
MD5
7c6c657834382d43c50d04ee26c33e90
-
SHA1
7f51d70498d88cf7e67c3a57b18ccfb3ec8f3ddd
-
SHA256
7b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861
-
SHA512
804692b04b857b0f11c3f82f4db2a3dd4e22425bc1f6f54a76c233ba43a92ebb5bc40ba6cf6049cdcc30dce5097ebac430c57f92a9a8fc3884e924d0389396bf
-
SSDEEP
768:OXYSubt6xO5wNtf98kitNT6J/2oO/aDvy:FSf5soOjuy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 568 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 708 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Loads dropped DLL 1 IoCs
pid Process 960 7b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 568 Trojan.exe 568 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 568 Trojan.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 960 wrote to memory of 568 960 7b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861.exe 28 PID 960 wrote to memory of 568 960 7b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861.exe 28 PID 960 wrote to memory of 568 960 7b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861.exe 28 PID 960 wrote to memory of 568 960 7b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861.exe 28 PID 568 wrote to memory of 708 568 Trojan.exe 29 PID 568 wrote to memory of 708 568 Trojan.exe 29 PID 568 wrote to memory of 708 568 Trojan.exe 29 PID 568 wrote to memory of 708 568 Trojan.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861.exe"C:\Users\Admin\AppData\Local\Temp\7b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:708
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD57c6c657834382d43c50d04ee26c33e90
SHA17f51d70498d88cf7e67c3a57b18ccfb3ec8f3ddd
SHA2567b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861
SHA512804692b04b857b0f11c3f82f4db2a3dd4e22425bc1f6f54a76c233ba43a92ebb5bc40ba6cf6049cdcc30dce5097ebac430c57f92a9a8fc3884e924d0389396bf
-
Filesize
43KB
MD57c6c657834382d43c50d04ee26c33e90
SHA17f51d70498d88cf7e67c3a57b18ccfb3ec8f3ddd
SHA2567b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861
SHA512804692b04b857b0f11c3f82f4db2a3dd4e22425bc1f6f54a76c233ba43a92ebb5bc40ba6cf6049cdcc30dce5097ebac430c57f92a9a8fc3884e924d0389396bf
-
Filesize
43KB
MD57c6c657834382d43c50d04ee26c33e90
SHA17f51d70498d88cf7e67c3a57b18ccfb3ec8f3ddd
SHA2567b739bb5d4c91b44c83bf60391ae79b01dce551fd7614005e255fb7a5f202861
SHA512804692b04b857b0f11c3f82f4db2a3dd4e22425bc1f6f54a76c233ba43a92ebb5bc40ba6cf6049cdcc30dce5097ebac430c57f92a9a8fc3884e924d0389396bf