Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
99s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
05/12/2022, 11:43
General
-
Target
9814044142eb590ace2658a202394d5dfdf63940913b373e7985e16836dd19d1.exe
-
Size
324KB
-
MD5
37f612fda2c0fd1f1f5a63e91aebbb2d
-
SHA1
6d00de148a63f1dde8988c2cd0e9562f00d30304
-
SHA256
9814044142eb590ace2658a202394d5dfdf63940913b373e7985e16836dd19d1
-
SHA512
27a7acc4bb9f7d4f142ce75945f91676c0f8fb2d342818f2ed3fdd280b50feb09bd5df15a0ef5946f249f8ae8c8de868f8167b3e0e77f83bd4942c6c2086a92f
-
SSDEEP
6144:cQoFKbHYm+SA9tBB5GBcRudjttS+jiNhF2sGdYJf4cWjZmK:DUms9x5GEOjtQ+jacsG9
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 30 IoCs
-
Suspicious use of SendNotifyMessage 20 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9814044142eb590ace2658a202394d5dfdf63940913b373e7985e16836dd19d1.exe"C:\Users\Admin\AppData\Local\Temp\9814044142eb590ace2658a202394d5dfdf63940913b373e7985e16836dd19d1.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\vjv.exe"C:\Users\Admin\AppData\Local\vjv.exe" -gav C:\Users\Admin\AppData\Local\Temp\9814044142eb590ace2658a202394d5dfdf63940913b373e7985e16836dd19d1.exe2⤵
- Executes dropped EXE
- Deletes itself
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4901⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
324KB
MD5e3cb0dff8db02e6f748edc6b2afc6281
SHA1793e852ed6f46f78f9f736501eb837b6556764c5
SHA256ca7a618a2e0df4e370dbda441e1c6aebe92011eb3d0e3f62e008ca4ad485263f
SHA512d9d9ceccf869ea17793c0ec538b353335676210d28ebe60a67da5c3512e87abda223558dbaaee8874f130f281b20a2984b5f62ff9641b8f3dc6e21112448485c
-
Filesize
324KB
MD5e3cb0dff8db02e6f748edc6b2afc6281
SHA1793e852ed6f46f78f9f736501eb837b6556764c5
SHA256ca7a618a2e0df4e370dbda441e1c6aebe92011eb3d0e3f62e008ca4ad485263f
SHA512d9d9ceccf869ea17793c0ec538b353335676210d28ebe60a67da5c3512e87abda223558dbaaee8874f130f281b20a2984b5f62ff9641b8f3dc6e21112448485c
-
Filesize
324KB
MD5e3cb0dff8db02e6f748edc6b2afc6281
SHA1793e852ed6f46f78f9f736501eb837b6556764c5
SHA256ca7a618a2e0df4e370dbda441e1c6aebe92011eb3d0e3f62e008ca4ad485263f
SHA512d9d9ceccf869ea17793c0ec538b353335676210d28ebe60a67da5c3512e87abda223558dbaaee8874f130f281b20a2984b5f62ff9641b8f3dc6e21112448485c
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
360KB
-
Filesize
4.1MB
-
Filesize
380KB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
4.1MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
8KB