Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
170s -
max time network
209s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
05/12/2022, 06:30
General
-
Target
c4ee1af6fd4fef42f5e3d70b7a854cf40afab8dfb0b26db4cb0066530b0693bc.exe
-
Size
280KB
-
MD5
5eb36d6a47672f55f552f7d0ff7f4093
-
SHA1
9110dc3355511ba0cfdb59e84c789a1695a2537c
-
SHA256
c4ee1af6fd4fef42f5e3d70b7a854cf40afab8dfb0b26db4cb0066530b0693bc
-
SHA512
72aff08e3557f231f8882084609c31a45ba1de38deb9bc7c92c2e35e66f4017684a0741ef0c8ef692fb69245901f6645329863ec5756f92659a3061b0874fd8c
-
SSDEEP
6144:zAqeJG9MfGXcLxVrorEucC6VUZabKoqsHYpN:zAqKG9sUmVrowuEbKXsHYpN
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 21 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4ee1af6fd4fef42f5e3d70b7a854cf40afab8dfb0b26db4cb0066530b0693bc.exe"C:\Users\Admin\AppData\Local\Temp\c4ee1af6fd4fef42f5e3d70b7a854cf40afab8dfb0b26db4cb0066530b0693bc.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\c4ee1af6fd4fef42f5e3d70b7a854cf40afab8dfb0b26db4cb0066530b0693bc.exeC:\Users\Admin\AppData\Local\Temp\c4ee1af6fd4fef42f5e3d70b7a854cf40afab8dfb0b26db4cb0066530b0693bc.exe startC:\Users\Admin\AppData\Roaming\63C4E\5EE76.exe%C:\Users\Admin\AppData\Roaming\63C4E2⤵
-
-
C:\Program Files (x86)\LP\7686\F567.tmp"C:\Program Files (x86)\LP\7686\F567.tmp"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\c4ee1af6fd4fef42f5e3d70b7a854cf40afab8dfb0b26db4cb0066530b0693bc.exeC:\Users\Admin\AppData\Local\Temp\c4ee1af6fd4fef42f5e3d70b7a854cf40afab8dfb0b26db4cb0066530b0693bc.exe startC:\Program Files (x86)\4E0F1\lvvm.exe%C:\Program Files (x86)\4E0F12⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5881⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD578193d48f57272fd9ea2e44ed86d608c
SHA11e70368bb5a0932f868fdddb22fd23dd2e7dedeb
SHA256c09d0876bbf956eb381d92a3e9dd61d49a4d65c1d2b65d3d42cb795256804aae
SHA5124f55914fe2d3780f174843b9f3666a10f63caae9634af925da3dc6aea5a3f6ab9e6ebf693698b781931ce794919558c59f7bfa22be94dc8b556784d948fa14c1
-
Filesize
97KB
MD578193d48f57272fd9ea2e44ed86d608c
SHA11e70368bb5a0932f868fdddb22fd23dd2e7dedeb
SHA256c09d0876bbf956eb381d92a3e9dd61d49a4d65c1d2b65d3d42cb795256804aae
SHA5124f55914fe2d3780f174843b9f3666a10f63caae9634af925da3dc6aea5a3f6ab9e6ebf693698b781931ce794919558c59f7bfa22be94dc8b556784d948fa14c1
-
Filesize
97KB
MD578193d48f57272fd9ea2e44ed86d608c
SHA11e70368bb5a0932f868fdddb22fd23dd2e7dedeb
SHA256c09d0876bbf956eb381d92a3e9dd61d49a4d65c1d2b65d3d42cb795256804aae
SHA5124f55914fe2d3780f174843b9f3666a10f63caae9634af925da3dc6aea5a3f6ab9e6ebf693698b781931ce794919558c59f7bfa22be94dc8b556784d948fa14c1
-
Filesize
8KB
-
Filesize
292KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
292KB
-
Filesize
428KB
-
Filesize
292KB
-
Filesize
8KB
-
Filesize
292KB
-
Filesize
428KB
-
Filesize
292KB
-
Filesize
108KB
-
Filesize
60KB
-
Filesize
108KB
-
Filesize
60KB