Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3Dump/dump1.exe
windows7-x64
3Dump/dump1.exe
windows10-2004-x64
3Original/9...6f.exe
windows7-x64
7Original/9...6f.exe
windows10-2004-x64
7Original/D...12.scr
windows7-x64
7Original/D...12.scr
windows10-2004-x64
7Original/b...12.exe
windows7-x64
7Original/b...12.exe
windows10-2004-x64
7Original/chqpl.exe
windows7-x64
7Original/chqpl.exe
windows10-2004-x64
7Original/d...4a.exe
windows7-x64
7Original/d...4a.exe
windows10-2004-x64
7Original/f...14.exe
windows7-x64
7Original/f...14.exe
windows10-2004-x64
7Original/l...25.exe
windows7-x64
7Original/l...25.exe
windows10-2004-x64
3Original/p...b9.dll
windows7-x64
8Original/p...b9.dll
windows10-2004-x64
8Unpacked/D...ed.exe
windows7-x64
7Unpacked/D...ed.exe
windows10-2004-x64
7Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13/07/2023, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
Dump/dump1.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral2
Sample
Dump/dump1.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral4
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Original/Document-772976_829712.scr
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral6
Sample
Original/Document-772976_829712.scr
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral8
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Original/chqpl.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral10
Sample
Original/chqpl.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral12
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Original/fax_390392029_072514.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral14
Sample
Original/fax_390392029_072514.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral16
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral18
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win7-20230712-en
windows7-x64
Behavioral task
behavioral20
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
General
-
Target
Original/dd207384b31d118745ebc83203a4b04a.exe
-
Size
538KB
-
MD5
dd207384b31d118745ebc83203a4b04a
-
SHA1
72dbfa32bc3a099833f3d2190371e3478d3324fc
-
SHA256
a4bc61a4b1b5cbfa25ae56d0fcf94424893a60abcb68aad2c0321f99e5d7b520
-
SHA512
60e6a0467d42171cfb07c33349789f3e679f498df483c7901ad04c3171c0bc324dc86c6b897928cf622873e20ac4e17a87ea88ecac8b555812b16d91f1fe954a
-
SSDEEP
12288:uEQTUs9+7tGwu0BubanwRfiHX3XVQtCJJaHPJGLhT:Tq+ebanwR6HXVQtg4HPA
Malware Config
Signatures
-
Allows Network login with blank passwords 1 TTPs 1 IoCs
Allows local user accounts with blank passwords to access device from the network.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\LimitBlankPasswordUse = "0" Process not Found -
Deletes itself 1 IoCs
pid Process 2336 NyhXwvHHknMkdXE.exe -
Executes dropped EXE 1 IoCs
pid Process 2336 NyhXwvHHknMkdXE.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\ne9bzef6m8.dll Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Process not Found File created C:\Windows\system32\config\systemprofile\AppData\Local\ne9bzef6m8.dll Process not Found -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\NyhXwvHHknMkdXE.exe dd207384b31d118745ebc83203a4b04a.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ACC0EA95-DCCC-45F2-8335-FFCC38E0161E} Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ACC0EA95-DCCC-45F2-8335-FFCC38E0161E}\WpadDecision = "0" Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-6f-ec-97-89-df\WpadDecisionTime = e0d27971dfb5d901 Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-6f-ec-97-89-df\WpadDecision = "0" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ACC0EA95-DCCC-45F2-8335-FFCC38E0161E}\WpadDecisionReason = "1" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ACC0EA95-DCCC-45F2-8335-FFCC38E0161E}\62-6f-ec-97-89-df Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ACC0EA95-DCCC-45F2-8335-FFCC38E0161E}\WpadDecisionTime = e0d27971dfb5d901 Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ACC0EA95-DCCC-45F2-8335-FFCC38E0161E}\WpadNetworkName = "Network 2" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-6f-ec-97-89-df Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-6f-ec-97-89-df\WpadDecisionReason = "1" Process not Found Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2208 dd207384b31d118745ebc83203a4b04a.exe 2336 NyhXwvHHknMkdXE.exe 2336 NyhXwvHHknMkdXE.exe 2336 NyhXwvHHknMkdXE.exe 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found 588 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2336 NyhXwvHHknMkdXE.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2208 dd207384b31d118745ebc83203a4b04a.exe Token: SeDebugPrivilege 2336 NyhXwvHHknMkdXE.exe Token: SeDebugPrivilege 588 Process not Found -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2208 dd207384b31d118745ebc83203a4b04a.exe 2336 NyhXwvHHknMkdXE.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2336 2208 dd207384b31d118745ebc83203a4b04a.exe 28 PID 2208 wrote to memory of 2336 2208 dd207384b31d118745ebc83203a4b04a.exe 28 PID 2208 wrote to memory of 2336 2208 dd207384b31d118745ebc83203a4b04a.exe 28 PID 2208 wrote to memory of 2336 2208 dd207384b31d118745ebc83203a4b04a.exe 28 PID 588 wrote to memory of 2916 588 Process not Found 30 PID 588 wrote to memory of 2916 588 Process not Found 30 PID 588 wrote to memory of 2916 588 Process not Found 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Original\dd207384b31d118745ebc83203a4b04a.exe"C:\Users\Admin\AppData\Local\Temp\Original\dd207384b31d118745ebc83203a4b04a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\NyhXwvHHknMkdXE.exeC:\Users\Admin\AppData\Local\Temp\Original\dd207384b31d118745ebc83203a4b04a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:2336
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:2916
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538KB
MD5dd207384b31d118745ebc83203a4b04a
SHA172dbfa32bc3a099833f3d2190371e3478d3324fc
SHA256a4bc61a4b1b5cbfa25ae56d0fcf94424893a60abcb68aad2c0321f99e5d7b520
SHA51260e6a0467d42171cfb07c33349789f3e679f498df483c7901ad04c3171c0bc324dc86c6b897928cf622873e20ac4e17a87ea88ecac8b555812b16d91f1fe954a