Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
188s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe
Resource
win10v2004-20230220-en
General
-
Target
5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe
-
Size
599KB
-
MD5
a1c0cdbe4fed5b65ca504ab0d26ea228
-
SHA1
c9fdf408b943872d47b6057255ec0982d435c365
-
SHA256
5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006
-
SHA512
80a4a1677dd04fe986730a374d78692e1421010cae0c6d04abbacbfb85e319de67bfeed250468c1a2594433b391aa766940b886b4f69e2a2d456c1b23f42beb8
-
SSDEEP
12288:/Mray9003w4cGqnh+1Q8rLZ9yrHOHSiJkxo8xckVKuy1X6cF+WEEREWf0+I:5ytxcV4GkDHS+kxljVKvNPEaV0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 340 y7794051.exe 1484 k3061196.exe -
Loads dropped DLL 4 IoCs
pid Process 1416 5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe 340 y7794051.exe 340 y7794051.exe 1484 k3061196.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce y7794051.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y7794051.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1416 wrote to memory of 340 1416 5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe 28 PID 1416 wrote to memory of 340 1416 5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe 28 PID 1416 wrote to memory of 340 1416 5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe 28 PID 1416 wrote to memory of 340 1416 5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe 28 PID 1416 wrote to memory of 340 1416 5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe 28 PID 1416 wrote to memory of 340 1416 5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe 28 PID 1416 wrote to memory of 340 1416 5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe 28 PID 340 wrote to memory of 1484 340 y7794051.exe 29 PID 340 wrote to memory of 1484 340 y7794051.exe 29 PID 340 wrote to memory of 1484 340 y7794051.exe 29 PID 340 wrote to memory of 1484 340 y7794051.exe 29 PID 340 wrote to memory of 1484 340 y7794051.exe 29 PID 340 wrote to memory of 1484 340 y7794051.exe 29 PID 340 wrote to memory of 1484 340 y7794051.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe"C:\Users\Admin\AppData\Local\Temp\5a970aa98f9cb64b6e9ebe664c8e967a275161d1910fabb8a50f908dad03f006.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7794051.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7794051.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3061196.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k3061196.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308KB
MD535de577ac6ae0146a256f849a801830f
SHA1b5ffa3f7157b0de3cac96aaec74da009559d1e61
SHA2569172aa928df40bae7066005db4b40de1e6ca960715f493d54204fe1e8bbaa9bd
SHA51239597b34c553b92cfa07d5009fef8446c8a8184e08862c2f364d576ffed3323a053ef864aff8c981dd161332de89aa5bfc55e59d7ffe03dd60218efbb85b4fd8
-
Filesize
308KB
MD535de577ac6ae0146a256f849a801830f
SHA1b5ffa3f7157b0de3cac96aaec74da009559d1e61
SHA2569172aa928df40bae7066005db4b40de1e6ca960715f493d54204fe1e8bbaa9bd
SHA51239597b34c553b92cfa07d5009fef8446c8a8184e08862c2f364d576ffed3323a053ef864aff8c981dd161332de89aa5bfc55e59d7ffe03dd60218efbb85b4fd8
-
Filesize
136KB
MD5d63e378013a0b95081cb5b3cb7b450f4
SHA1e607b2f549cdd205b8f699a446e6607f2b08b82d
SHA256977e125dfb9abf472216b0da77980025c102644b806ef6252f70f38d9e5567c1
SHA5126eb30e00f571c6a22dcb50f3e4f9eaecff42a7aceca9dcd9be401bac7d8e23575c9511a1d87ec330615f97e66ac0e7845c3853a0f1e8d5fbd6caa600f482d1c6
-
Filesize
136KB
MD5d63e378013a0b95081cb5b3cb7b450f4
SHA1e607b2f549cdd205b8f699a446e6607f2b08b82d
SHA256977e125dfb9abf472216b0da77980025c102644b806ef6252f70f38d9e5567c1
SHA5126eb30e00f571c6a22dcb50f3e4f9eaecff42a7aceca9dcd9be401bac7d8e23575c9511a1d87ec330615f97e66ac0e7845c3853a0f1e8d5fbd6caa600f482d1c6
-
Filesize
308KB
MD535de577ac6ae0146a256f849a801830f
SHA1b5ffa3f7157b0de3cac96aaec74da009559d1e61
SHA2569172aa928df40bae7066005db4b40de1e6ca960715f493d54204fe1e8bbaa9bd
SHA51239597b34c553b92cfa07d5009fef8446c8a8184e08862c2f364d576ffed3323a053ef864aff8c981dd161332de89aa5bfc55e59d7ffe03dd60218efbb85b4fd8
-
Filesize
308KB
MD535de577ac6ae0146a256f849a801830f
SHA1b5ffa3f7157b0de3cac96aaec74da009559d1e61
SHA2569172aa928df40bae7066005db4b40de1e6ca960715f493d54204fe1e8bbaa9bd
SHA51239597b34c553b92cfa07d5009fef8446c8a8184e08862c2f364d576ffed3323a053ef864aff8c981dd161332de89aa5bfc55e59d7ffe03dd60218efbb85b4fd8
-
Filesize
136KB
MD5d63e378013a0b95081cb5b3cb7b450f4
SHA1e607b2f549cdd205b8f699a446e6607f2b08b82d
SHA256977e125dfb9abf472216b0da77980025c102644b806ef6252f70f38d9e5567c1
SHA5126eb30e00f571c6a22dcb50f3e4f9eaecff42a7aceca9dcd9be401bac7d8e23575c9511a1d87ec330615f97e66ac0e7845c3853a0f1e8d5fbd6caa600f482d1c6
-
Filesize
136KB
MD5d63e378013a0b95081cb5b3cb7b450f4
SHA1e607b2f549cdd205b8f699a446e6607f2b08b82d
SHA256977e125dfb9abf472216b0da77980025c102644b806ef6252f70f38d9e5567c1
SHA5126eb30e00f571c6a22dcb50f3e4f9eaecff42a7aceca9dcd9be401bac7d8e23575c9511a1d87ec330615f97e66ac0e7845c3853a0f1e8d5fbd6caa600f482d1c6