Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2023, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
M7R47913.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
M7R47913.exe
Resource
win10v2004-20230220-en
General
-
Target
M7R47913.exe
-
Size
7.0MB
-
MD5
d86486fdcc9747b5ccf9a246dfa727dd
-
SHA1
e580268cebc790fc7ec88cb019731f0c903a1a15
-
SHA256
58428d81dab5ddde27d35078c1a775dc6bffa4a815dad9779e9f6eeaa19dd877
-
SHA512
7555efdee463de2cffe2ea6afa1edf12cf5a2bc4ad752a88d361f1fca9b91e37db082317e98cea2554ede5e94a4d25e0a18075d32974ad8cb99f0cbc48d80f9a
-
SSDEEP
98304:Bo82lrwQnUKp8wut0BdTJAVp9jgeVpBiqLUBH76Pva0yTIpOmn2w9NAHr:ByfUew0BdaH3BfUKvac2aNS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2552 MicrosoftSoftwareDistribution-SYQ237.1.8.6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Software\Microsoft\Windows\CurrentVersion\Run M7R47913.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftSoftwareDistribution-SYQ237.1.8.6 = "C:\\ProgramData\\MicrosoftSoftwareDistribution-SYQ237.1.8.6\\MicrosoftSoftwareDistribution-SYQ237.1.8.6.exe" M7R47913.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 548 wrote to memory of 2552 548 M7R47913.exe 85 PID 548 wrote to memory of 2552 548 M7R47913.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\M7R47913.exe"C:\Users\Admin\AppData\Local\Temp\M7R47913.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:548 -
C:\ProgramData\MicrosoftSoftwareDistribution-SYQ237.1.8.6\MicrosoftSoftwareDistribution-SYQ237.1.8.6.exeC:\ProgramData\MicrosoftSoftwareDistribution-SYQ237.1.8.6\MicrosoftSoftwareDistribution-SYQ237.1.8.6.exe2⤵
- Executes dropped EXE
PID:2552
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\MicrosoftSoftwareDistribution-SYQ237.1.8.6\MicrosoftSoftwareDistribution-SYQ237.1.8.6.exe
Filesize757.0MB
MD5e3c92a18d95db0083ec4e0e340a78a87
SHA142c2db1c711a58d9217c3055751913c8bf6d7c26
SHA256108369cf181018332525f1a450577cc5d132e6d23e5644bd6184da2c230712ca
SHA5124013d92596a2dfbca75e2cfb267cd97ce692b19862cb4509456ad3da98b7dffcd004f03a3c99d8cb43dda136307abdc1bfb9b7869e13383d362edc1de6fb91ab
-
C:\ProgramData\MicrosoftSoftwareDistribution-SYQ237.1.8.6\MicrosoftSoftwareDistribution-SYQ237.1.8.6.exe
Filesize757.0MB
MD5e3c92a18d95db0083ec4e0e340a78a87
SHA142c2db1c711a58d9217c3055751913c8bf6d7c26
SHA256108369cf181018332525f1a450577cc5d132e6d23e5644bd6184da2c230712ca
SHA5124013d92596a2dfbca75e2cfb267cd97ce692b19862cb4509456ad3da98b7dffcd004f03a3c99d8cb43dda136307abdc1bfb9b7869e13383d362edc1de6fb91ab