Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 20:13
Static task
static1
Behavioral task
behavioral1
Sample
03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe
Resource
win10v2004-20230220-en
General
-
Target
03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe
-
Size
479KB
-
MD5
973bb318f1df1f635491077188ac5e4b
-
SHA1
3e59a536851d015cf186b5e756a8ee60d0aa9bfc
-
SHA256
03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd
-
SHA512
c57bf5fce21e3866f0bbec8d1e86755c277c989ecbeb80eb124ec86eed5b228c94835ccd6e1d188537e90375d83f120965e1c4487c7a8b68f3eb838f32fc4f35
-
SSDEEP
12288:bMrjty90OZ13IXn7rWGsdLfBMdd/uST1a7Cfx:0tyTU7rWGmLSdwSxR5
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 684 x8409730.exe 1680 g7320293.exe -
Loads dropped DLL 4 IoCs
pid Process 1096 03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe 684 x8409730.exe 684 x8409730.exe 1680 g7320293.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce x8409730.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x8409730.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1096 wrote to memory of 684 1096 03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe 28 PID 1096 wrote to memory of 684 1096 03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe 28 PID 1096 wrote to memory of 684 1096 03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe 28 PID 1096 wrote to memory of 684 1096 03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe 28 PID 1096 wrote to memory of 684 1096 03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe 28 PID 1096 wrote to memory of 684 1096 03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe 28 PID 1096 wrote to memory of 684 1096 03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe 28 PID 684 wrote to memory of 1680 684 x8409730.exe 29 PID 684 wrote to memory of 1680 684 x8409730.exe 29 PID 684 wrote to memory of 1680 684 x8409730.exe 29 PID 684 wrote to memory of 1680 684 x8409730.exe 29 PID 684 wrote to memory of 1680 684 x8409730.exe 29 PID 684 wrote to memory of 1680 684 x8409730.exe 29 PID 684 wrote to memory of 1680 684 x8409730.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe"C:\Users\Admin\AppData\Local\Temp\03486810ae4e24c6532938d0c5a5a4ecc13a4f6bfaf0d8b4367b88922d67e6dd.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8409730.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8409730.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7320293.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g7320293.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307KB
MD5a150e3b563bc4a94f4cfb60b454cfd75
SHA1e7252f55fefdcf87eb9dddef0fd404946c59d198
SHA256b021db168d7a53f27376e459029bcc70ec637a23632255e06fe5e4acc4abeffa
SHA512bdecc46c4a72498f59d4191ac17d07b27f212db562f00d34189016149a07615a0ab1218df68c6d873bee33503cc995f2c71b36a2cb9cc1fc55a668c1eecbf071
-
Filesize
307KB
MD5a150e3b563bc4a94f4cfb60b454cfd75
SHA1e7252f55fefdcf87eb9dddef0fd404946c59d198
SHA256b021db168d7a53f27376e459029bcc70ec637a23632255e06fe5e4acc4abeffa
SHA512bdecc46c4a72498f59d4191ac17d07b27f212db562f00d34189016149a07615a0ab1218df68c6d873bee33503cc995f2c71b36a2cb9cc1fc55a668c1eecbf071
-
Filesize
137KB
MD523de4b48a1351aa2ae1efeaadd269604
SHA19523df2ef8b2c651d8f6f995734f970edc188746
SHA256dd7f29e2c72025047bcfeac4cd65ae9840401f5eaa50bd2e91db464bbb7a61b0
SHA512a88c985f01bacc933bfddf3441413898dbcaa745c576576daf70fa14bb8954f5e8b6712e3395d4a646dd04f7703788b0d8107e1ff20c35fd19f40be46e241cbd
-
Filesize
137KB
MD523de4b48a1351aa2ae1efeaadd269604
SHA19523df2ef8b2c651d8f6f995734f970edc188746
SHA256dd7f29e2c72025047bcfeac4cd65ae9840401f5eaa50bd2e91db464bbb7a61b0
SHA512a88c985f01bacc933bfddf3441413898dbcaa745c576576daf70fa14bb8954f5e8b6712e3395d4a646dd04f7703788b0d8107e1ff20c35fd19f40be46e241cbd
-
Filesize
307KB
MD5a150e3b563bc4a94f4cfb60b454cfd75
SHA1e7252f55fefdcf87eb9dddef0fd404946c59d198
SHA256b021db168d7a53f27376e459029bcc70ec637a23632255e06fe5e4acc4abeffa
SHA512bdecc46c4a72498f59d4191ac17d07b27f212db562f00d34189016149a07615a0ab1218df68c6d873bee33503cc995f2c71b36a2cb9cc1fc55a668c1eecbf071
-
Filesize
307KB
MD5a150e3b563bc4a94f4cfb60b454cfd75
SHA1e7252f55fefdcf87eb9dddef0fd404946c59d198
SHA256b021db168d7a53f27376e459029bcc70ec637a23632255e06fe5e4acc4abeffa
SHA512bdecc46c4a72498f59d4191ac17d07b27f212db562f00d34189016149a07615a0ab1218df68c6d873bee33503cc995f2c71b36a2cb9cc1fc55a668c1eecbf071
-
Filesize
137KB
MD523de4b48a1351aa2ae1efeaadd269604
SHA19523df2ef8b2c651d8f6f995734f970edc188746
SHA256dd7f29e2c72025047bcfeac4cd65ae9840401f5eaa50bd2e91db464bbb7a61b0
SHA512a88c985f01bacc933bfddf3441413898dbcaa745c576576daf70fa14bb8954f5e8b6712e3395d4a646dd04f7703788b0d8107e1ff20c35fd19f40be46e241cbd
-
Filesize
137KB
MD523de4b48a1351aa2ae1efeaadd269604
SHA19523df2ef8b2c651d8f6f995734f970edc188746
SHA256dd7f29e2c72025047bcfeac4cd65ae9840401f5eaa50bd2e91db464bbb7a61b0
SHA512a88c985f01bacc933bfddf3441413898dbcaa745c576576daf70fa14bb8954f5e8b6712e3395d4a646dd04f7703788b0d8107e1ff20c35fd19f40be46e241cbd