Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
29/06/2023, 23:38
Static task
static1
Behavioral task
behavioral1
Sample
shellcode.exe
Resource
win10-20230621-en
Behavioral task
behavioral2
Sample
shellcode.exe
Resource
win7-20230621-en
Behavioral task
behavioral3
Sample
shellcode.exe
Resource
win10v2004-20230621-en
General
-
Target
shellcode.exe
-
Size
919KB
-
MD5
92d4a332c8ae484c34be3dd83df32aa0
-
SHA1
b07c730ce9f10f86de65f6fe1d138f1fd1d50b50
-
SHA256
fa6825365bc9ba1a5cff781906e359abb275fca68458198d2c230e94eed8fbdf
-
SHA512
a97c48b7c869713d0b46f1c829cc5910b473513d27f28c4591e31406137191b7c2202011ba6e7f65e0405da36eccb2d28d66de4267b926899b96fe9513e3a3a7
-
SSDEEP
24576:5376zKVukBvguELCrliSPvFLxrbnszyGmuF:p2KJvgze0SnIGGmuF
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000\Software\Microsoft\Windows\CurrentVersion\Run\a36f0dda66754ff3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ose00000.exe" shellcode.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib shellcode.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8acc2016-04a3-4343-b8e1-1870e35d6a41} shellcode.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8acc2016-04a3-4343-b8e1-1870e35d6a41}\1.0 shellcode.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8acc2016-04a3-4343-b8e1-1870e35d6a41}\1.0\0 shellcode.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8acc2016-04a3-4343-b8e1-1870e35d6a41}\1.0\0\win64 shellcode.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2040 shellcode.exe 2040 shellcode.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2040 shellcode.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe 2040 shellcode.exe 304 DllHost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\shellcode.exe"C:\Users\Admin\AppData\Local\Temp\shellcode.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2040
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
- Suspicious use of SetWindowsHookEx
PID:304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD570fda443b991c414a62a4e13a22139c6
SHA11e896dd4209bf4534eaebacedcfeaf39b09a19ef
SHA25633d7c85e71b7bbaab855de0990626b9ccda74fe64b074cc3a8e4aba2c1aac8f1
SHA512c615df9362001c4fe72860b11beb3a2c8494893e1632489cf0f29820b2aa0ebecf310d33d6de6eda34f7a14840144a17edaf8043777c634bac06708f352116e8