Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06/01/2023, 06:59
Static task
static1
Behavioral task
behavioral1
Sample
611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe
Resource
win10v2004-20221111-en
General
-
Target
611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe
-
Size
441KB
-
MD5
6d906bd5d8a13d4f606a3b97fae99ad8
-
SHA1
611a9e4c291ecd531c6f8f19afc436ea303f5f08
-
SHA256
e19411b76e85354c5d53a959772efca2ed0315a6e7f74c4bd421edc03022d623
-
SHA512
eb35fccd3facb2b88c6d0600ae9f2ed188909b63b83f3800d63c37cbb05d596bc8582dc9f691532b3e79102088dcfcf06eb3026e90ecc40c6b29d31857f164ba
-
SSDEEP
6144:B5aWbksiNTBTSJfzmTFZjI+wCtNNHxfLf0Gq0eMmv+bYR8Byaewr8z5PEtmprDWE:B5atNTFSJfzmTLTxxfo0eMqJut5CeE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 932 extd.exe -
resource yara_rule behavioral1/files/0x0006000000014150-57.dat upx behavioral1/files/0x0006000000014150-59.dat upx behavioral1/memory/932-61-0x0000000000400000-0x00000000004A5000-memory.dmp upx -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 932 extd.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1532 wrote to memory of 1420 1532 611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe 29 PID 1532 wrote to memory of 1420 1532 611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe 29 PID 1532 wrote to memory of 1420 1532 611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe 29 PID 1532 wrote to memory of 1420 1532 611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe 29 PID 1420 wrote to memory of 932 1420 cmd.exe 30 PID 1420 wrote to memory of 932 1420 cmd.exe 30 PID 1420 wrote to memory of 932 1420 cmd.exe 30 PID 1420 wrote to memory of 932 1420 cmd.exe 30 PID 1420 wrote to memory of 1060 1420 cmd.exe 31 PID 1420 wrote to memory of 1060 1420 cmd.exe 31 PID 1420 wrote to memory of 1060 1420 cmd.exe 31 PID 1420 wrote to memory of 1116 1420 cmd.exe 32 PID 1420 wrote to memory of 1116 1420 cmd.exe 32 PID 1420 wrote to memory of 1116 1420 cmd.exe 32 PID 1420 wrote to memory of 432 1420 cmd.exe 33 PID 1420 wrote to memory of 432 1420 cmd.exe 33 PID 1420 wrote to memory of 432 1420 cmd.exe 33 PID 1420 wrote to memory of 544 1420 cmd.exe 36 PID 1420 wrote to memory of 544 1420 cmd.exe 36 PID 1420 wrote to memory of 544 1420 cmd.exe 36 PID 1420 wrote to memory of 336 1420 cmd.exe 38 PID 1420 wrote to memory of 336 1420 cmd.exe 38 PID 1420 wrote to memory of 336 1420 cmd.exe 38 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 544 attrib.exe 336 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe"C:\Users\Admin\AppData\Local\Temp\611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\964.tmp\975.tmp\976.bat C:\Users\Admin\AppData\Local\Temp\611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\964.tmp\975.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\964.tmp\975.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:932
-
-
C:\Windows\system32\reg.exereg delete HKCR/.exe3⤵PID:1060
-
-
C:\Windows\system32\reg.exereg delete HKCR/.dll3⤵PID:1116
-
-
C:\Windows\system32\reg.exereg delete HKCR/*3⤵PID:432
-
-
C:\Windows\system32\attrib.exeattrib -r -s -h c:bootmgr3⤵
- Views/modifies file attributes
PID:544
-
-
C:\Windows\system32\attrib.exeattrib -r -s -h c:bootmgr.sys3⤵
- Views/modifies file attributes
PID:336
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD52bdbce03c1b1106b7ab726fceaad814c
SHA13aac18f303b2037816b3d9cddc6d965a2567d625
SHA256f6fbfe7d62597a81e63418936fc31863594906fcf2daefa79e9b39f23deb039d
SHA512759118d4d0d086cdfdd23856ee3671c708ba78df2c2edacb76faef107c42c3c0d105e508f890da452c4ec19f9a3bc25639d9d757ab99793d34fd5daa1f5e9037
-
Filesize
259KB
MD5139b5ce627bc9ec1040a91ebe7830f7c
SHA1c7e8154ebed98bea9d1f12b08139d130b6836826
SHA256d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
SHA5128cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b
-
Filesize
259KB
MD5139b5ce627bc9ec1040a91ebe7830f7c
SHA1c7e8154ebed98bea9d1f12b08139d130b6836826
SHA256d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332
SHA5128cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b