Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 17:36
Behavioral task
behavioral1
Sample
b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
Resource
win10v2004-20220812-en
General
-
Target
b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe
-
Size
404KB
-
MD5
6fc529de07d137f3ee1ba04f5ff6e5c4
-
SHA1
4e6884206ce49342ebef7d03dd81dd6dbed7a60f
-
SHA256
b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760
-
SHA512
c725d789f0d50333ec620b2ebfb52261b12cf1d7d3724b67d506c6aeca698777b7e535bb9fe541aa3627e1a7272cd2e028db53fc3c8f69a41bf2bb2d73934ca8
-
SSDEEP
12288:35Bevhp0wpE9z/uXagSAiLNZQ4i696+IUvbOI2/Kmu7wxwj:gWqJSzZOCIiiymuf
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1956-56-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\MBR Regenerator\core\engine86.$$A b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe File created C:\Windows\MBR Regenerator\core\engine86.$AA b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe File created C:\Windows\MBR Regenerator\core\hosts.$$A b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe File created C:\Windows\MBR Regenerator\core\scanner.$$A b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe File created C:\Windows\MBR Regenerator\core\sfc32\sfc.$$A b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe File opened for modification C:\Windows\MBR Regenerator\core\sfc64\sfc.exe b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe File created C:\Windows\MBR Regenerator\core\engine64.$$A b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe File created C:\Windows\MBR Regenerator\core\sfc64\sfc.$$A b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe File created C:\Windows\MBR Regenerator\core\sfc64\sfc.$AA b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe File created C:\Windows\MBR Regenerator\core\sleep.$$A b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe File created C:\Windows\MBR Regenerator\engine.$$A b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe File created C:\Windows\MBR Regenerator\core\bootsect.$$A b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1956 wrote to memory of 1784 1956 b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe 28 PID 1956 wrote to memory of 1784 1956 b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe 28 PID 1956 wrote to memory of 1784 1956 b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe 28 PID 1956 wrote to memory of 1784 1956 b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe 28 PID 1784 wrote to memory of 768 1784 cmd.exe 30 PID 1784 wrote to memory of 768 1784 cmd.exe 30 PID 1784 wrote to memory of 768 1784 cmd.exe 30 PID 1784 wrote to memory of 768 1784 cmd.exe 30 PID 1784 wrote to memory of 672 1784 cmd.exe 31 PID 1784 wrote to memory of 672 1784 cmd.exe 31 PID 1784 wrote to memory of 672 1784 cmd.exe 31 PID 1784 wrote to memory of 672 1784 cmd.exe 31 PID 1784 wrote to memory of 1164 1784 cmd.exe 32 PID 1784 wrote to memory of 1164 1784 cmd.exe 32 PID 1784 wrote to memory of 1164 1784 cmd.exe 32 PID 1784 wrote to memory of 1164 1784 cmd.exe 32 PID 1784 wrote to memory of 1920 1784 cmd.exe 33 PID 1784 wrote to memory of 1920 1784 cmd.exe 33 PID 1784 wrote to memory of 1920 1784 cmd.exe 33 PID 1784 wrote to memory of 1920 1784 cmd.exe 33 PID 1784 wrote to memory of 588 1784 cmd.exe 34 PID 1784 wrote to memory of 588 1784 cmd.exe 34 PID 1784 wrote to memory of 588 1784 cmd.exe 34 PID 1784 wrote to memory of 588 1784 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe"C:\Users\Admin\AppData\Local\Temp\b1d26549e2124ad2218a1cfdec72005955b7f589037576896c989c4025873760.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Windows\MBR Regenerator\engine.cmd""2⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\mode.commode con: cols=80 lines=163⤵PID:768
-
-
C:\Windows\SysWOW64\reg.exeREG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName"3⤵PID:672
-
-
C:\Windows\SysWOW64\findstr.exeFINDSTR "7"3⤵PID:1164
-
-
C:\Windows\SysWOW64\reg.exeREG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName3⤵PID:1920
-
-
C:\Windows\SysWOW64\find.exefind /i "Ultimate"3⤵PID:588
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD59807689728c81d44376164beaed5498f
SHA194052d250b3d6dba4cd002b04fa8c933353a429a
SHA256c2e381524ea02e1a447c0f091da8d695ba5be58c707f09486080a282bceaeb05
SHA512ab71c1686d858e80eec4d04d220b140dce08c14f811bdd034eaf77bf616202341356b127c65777a85af629633108b98c5aeddb94c70fc6a2342bc4b5d49ced09