Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10/02/2023, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
357KB
-
MD5
88d3588e92f5c5f99a2e036252a9d281
-
SHA1
1ed1ce7b4cb75db17e90efd41349754113648fe0
-
SHA256
92afdac37111654925657288e25740c7291896b233c012e41ecd23e81b53dee4
-
SHA512
0b3e93cd59bb5fc8fe6fffe11c35e34fb0bb77bf1af10ce199c53715c09385b5f5b046b625bb6c1f4a0f7109030d5968fc128346de682d22827893e03d1c6131
-
SSDEEP
3072:0wHqb7eKdaMaTK8CyR6sb9SuqXZW8Va5tWGYkK/FBRA9nf6Nh382UUf/:pH6tauXsb96p/a5LVK/XR2nfWhsA/
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\xjsvjrss = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1644 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\xjsvjrss\ImagePath = "C:\\Windows\\SysWOW64\\xjsvjrss\\dwtbslfc.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 1588 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1816 dwtbslfc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1816 set thread context of 1588 1816 dwtbslfc.exe 39 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 956 sc.exe 1604 sc.exe 2012 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 856 wrote to memory of 1344 856 file.exe 26 PID 856 wrote to memory of 1344 856 file.exe 26 PID 856 wrote to memory of 1344 856 file.exe 26 PID 856 wrote to memory of 1344 856 file.exe 26 PID 856 wrote to memory of 1540 856 file.exe 28 PID 856 wrote to memory of 1540 856 file.exe 28 PID 856 wrote to memory of 1540 856 file.exe 28 PID 856 wrote to memory of 1540 856 file.exe 28 PID 856 wrote to memory of 956 856 file.exe 30 PID 856 wrote to memory of 956 856 file.exe 30 PID 856 wrote to memory of 956 856 file.exe 30 PID 856 wrote to memory of 956 856 file.exe 30 PID 856 wrote to memory of 1604 856 file.exe 32 PID 856 wrote to memory of 1604 856 file.exe 32 PID 856 wrote to memory of 1604 856 file.exe 32 PID 856 wrote to memory of 1604 856 file.exe 32 PID 856 wrote to memory of 2012 856 file.exe 34 PID 856 wrote to memory of 2012 856 file.exe 34 PID 856 wrote to memory of 2012 856 file.exe 34 PID 856 wrote to memory of 2012 856 file.exe 34 PID 856 wrote to memory of 1644 856 file.exe 37 PID 856 wrote to memory of 1644 856 file.exe 37 PID 856 wrote to memory of 1644 856 file.exe 37 PID 856 wrote to memory of 1644 856 file.exe 37 PID 1816 wrote to memory of 1588 1816 dwtbslfc.exe 39 PID 1816 wrote to memory of 1588 1816 dwtbslfc.exe 39 PID 1816 wrote to memory of 1588 1816 dwtbslfc.exe 39 PID 1816 wrote to memory of 1588 1816 dwtbslfc.exe 39 PID 1816 wrote to memory of 1588 1816 dwtbslfc.exe 39 PID 1816 wrote to memory of 1588 1816 dwtbslfc.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xjsvjrss\2⤵PID:1344
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dwtbslfc.exe" C:\Windows\SysWOW64\xjsvjrss\2⤵PID:1540
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create xjsvjrss binPath= "C:\Windows\SysWOW64\xjsvjrss\dwtbslfc.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:956
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description xjsvjrss "wifi internet conection"2⤵
- Launches sc.exe
PID:1604
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start xjsvjrss2⤵
- Launches sc.exe
PID:2012
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:1644
-
-
C:\Windows\SysWOW64\xjsvjrss\dwtbslfc.exeC:\Windows\SysWOW64\xjsvjrss\dwtbslfc.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:1588
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.8MB
MD5baed2a7a9613fb92cd5037674b521b39
SHA1ae0b9bd97b7b758494d2f99b07775652d6aabc30
SHA256c074dd78979b3ae3adfd39cfc7fbbbd59885558b5c516a4067c77a941bf1181c
SHA512e6d90580e414245f75fe49303d2bef4a158bd95db2ae34a709939898032867759fa14f864dcf8811e0d23be6edfaa2177940e112da25a8fcf45796184dc5dc5a
-
Filesize
10.8MB
MD5baed2a7a9613fb92cd5037674b521b39
SHA1ae0b9bd97b7b758494d2f99b07775652d6aabc30
SHA256c074dd78979b3ae3adfd39cfc7fbbbd59885558b5c516a4067c77a941bf1181c
SHA512e6d90580e414245f75fe49303d2bef4a158bd95db2ae34a709939898032867759fa14f864dcf8811e0d23be6edfaa2177940e112da25a8fcf45796184dc5dc5a