Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 03:05
Static task
static1
Behavioral task
behavioral1
Sample
3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe
Resource
win10v2004-20220901-en
General
-
Target
3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe
-
Size
37KB
-
MD5
0d5ecbddfb341e9cbe0abe4d63d912b0
-
SHA1
ebe8adf2ade62bd523626b6d53ec20f65e1874dd
-
SHA256
3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2
-
SHA512
6ad753d2acd1d529f15cdd3ee1e2a510d149c856a2e7320362cf1afd9807c75b931c5990b9f3fe0eef21ed9311f7ae5489e7ab3b1585c09b91a6966acc488e62
-
SSDEEP
768:vhSeJiWaxtEvzx22NiQknwaQCXlnFXdwe4p9G3jRoOE+p+:ZfStEvt22N57MT5o0NoLw+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1920 SVCH0SFT.EXE -
Deletes itself 1 IoCs
pid Process 676 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 956 cmd.exe 956 cmd.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\SVCH0SFT.EXE cmd.exe File opened for modification C:\Windows\SysWOW64\SVCH0SFT.EXE cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1488 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 996 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 1920 SVCH0SFT.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 996 wrote to memory of 956 996 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 27 PID 996 wrote to memory of 956 996 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 27 PID 996 wrote to memory of 956 996 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 27 PID 996 wrote to memory of 956 996 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 27 PID 956 wrote to memory of 1920 956 cmd.exe 29 PID 956 wrote to memory of 1920 956 cmd.exe 29 PID 956 wrote to memory of 1920 956 cmd.exe 29 PID 956 wrote to memory of 1920 956 cmd.exe 29 PID 956 wrote to memory of 1488 956 cmd.exe 30 PID 956 wrote to memory of 1488 956 cmd.exe 30 PID 956 wrote to memory of 1488 956 cmd.exe 30 PID 956 wrote to memory of 1488 956 cmd.exe 30 PID 996 wrote to memory of 676 996 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 31 PID 996 wrote to memory of 676 996 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 31 PID 996 wrote to memory of 676 996 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 31 PID 996 wrote to memory of 676 996 3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe"C:\Users\Admin\AppData\Local\Temp\3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\~gagad2.bat2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\SVCH0SFT.EXESVCH0SFT.EXE3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1920
-
-
C:\Windows\SysWOW64\PING.EXEping 127.13⤵
- Runs ping.exe
PID:1488
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\3445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2.exe"2⤵
- Deletes itself
PID:676
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336B
MD5e8479cc3204be57fc21f818a0b328578
SHA1618d786ec3f1ed9d2fbce4ae89d666d6d3210964
SHA2563af41568d9c3864716c0d964a6e9ba5d628c9fa320832a5d95404043d85ddb51
SHA51274a72514799409f016f24d6b55fa6c086ce385b01d2e1f045f6f9b88320c680dcc6a0dd9a154bf98ff01d1c550591c03aaf019e4c45247814949159036f894fd
-
Filesize
37KB
MD50d5ecbddfb341e9cbe0abe4d63d912b0
SHA1ebe8adf2ade62bd523626b6d53ec20f65e1874dd
SHA2563445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2
SHA5126ad753d2acd1d529f15cdd3ee1e2a510d149c856a2e7320362cf1afd9807c75b931c5990b9f3fe0eef21ed9311f7ae5489e7ab3b1585c09b91a6966acc488e62
-
Filesize
37KB
MD50d5ecbddfb341e9cbe0abe4d63d912b0
SHA1ebe8adf2ade62bd523626b6d53ec20f65e1874dd
SHA2563445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2
SHA5126ad753d2acd1d529f15cdd3ee1e2a510d149c856a2e7320362cf1afd9807c75b931c5990b9f3fe0eef21ed9311f7ae5489e7ab3b1585c09b91a6966acc488e62
-
Filesize
37KB
MD50d5ecbddfb341e9cbe0abe4d63d912b0
SHA1ebe8adf2ade62bd523626b6d53ec20f65e1874dd
SHA2563445353d18d7cb9c956b1a16b52a35eb8467fa296c238a900a414241ecd205c2
SHA5126ad753d2acd1d529f15cdd3ee1e2a510d149c856a2e7320362cf1afd9807c75b931c5990b9f3fe0eef21ed9311f7ae5489e7ab3b1585c09b91a6966acc488e62