Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 11:27
Static task
static1
Behavioral task
behavioral1
Sample
efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe
Resource
win10v2004-20220812-en
Errors
General
-
Target
efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe
-
Size
301KB
-
MD5
04b1057e2795043a6a7681ac951c6506
-
SHA1
a174173bc54629f7a9d8972dfc0731c1e7916d3b
-
SHA256
efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4
-
SHA512
6491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f
-
SSDEEP
6144:eMghXT2rtzWLM4DCAgdCNh4rhJBiWSnG85jI4:e7wyEdCD4rBSnGY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 872 x2z8.exe -
Loads dropped DLL 2 IoCs
pid Process 1016 efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe 1016 efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe File opened for modification \??\PHYSICALDRIVE0 x2z8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 872 x2z8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1016 wrote to memory of 872 1016 efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe 28 PID 1016 wrote to memory of 872 1016 efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe 28 PID 1016 wrote to memory of 872 1016 efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe 28 PID 1016 wrote to memory of 872 1016 efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe"C:\Users\Admin\AppData\Local\Temp\efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\x2z8.exeC:\Users\Admin\AppData\Local\Temp\\x2z8.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:872
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1396
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102B
MD5963a5daddeb4abebe5ac4195b71ca1bd
SHA1cd26eebb37a32c0ce9ef24b9b0b52eb6d9f23567
SHA2564ed801b3b77e4f53f3f6ecdff3547052987272063e0e027d90aaeca3fd44e2d0
SHA512a3631d5cfbf0ebc59d9bdc1ca2f8b088314111a914fa23e81f9e54385a79c12b6b1e2e3bcbb08586416ac39cb06b98df22b90b6fe4f470d581ac7922b6ddaedf
-
Filesize
301KB
MD504b1057e2795043a6a7681ac951c6506
SHA1a174173bc54629f7a9d8972dfc0731c1e7916d3b
SHA256efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4
SHA5126491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f
-
Filesize
301KB
MD504b1057e2795043a6a7681ac951c6506
SHA1a174173bc54629f7a9d8972dfc0731c1e7916d3b
SHA256efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4
SHA5126491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f
-
Filesize
301KB
MD504b1057e2795043a6a7681ac951c6506
SHA1a174173bc54629f7a9d8972dfc0731c1e7916d3b
SHA256efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4
SHA5126491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f