Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
17/08/2023, 15:52
Static task
static1
Behavioral task
behavioral1
Sample
ade04d8a75cdd78300fb20b8f7f1877700e800486c18398605e430238e771389.zip
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ade04d8a75cdd78300fb20b8f7f1877700e800486c18398605e430238e771389.zip
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
New Order.exe
Resource
win7-20230712-en
General
-
Target
New Order.exe
-
Size
889KB
-
MD5
9cf6063608f250626f2834856396092c
-
SHA1
98371d8f9c1002fb0f916c99649bea2ce6cae1b3
-
SHA256
c9e9c0c331d38ad123557f095bf0eb4ee4e11d00a6b39e923a33e18102f91d4f
-
SHA512
fc81ee5bcd34dc55ad161ac8dbf4afb1cdd54affab694b4c39f0a2d088ed1e529ba001fa4199278054c5efc349edb404bcd18eb79a1921defc7e4746c9d2b842
-
SSDEEP
12288:dHsLMTTxTdyFOILC3KrXwX8dZAg6jumsMT:dHQGdVIO3cXwMzAPi3
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1136 set thread context of 2452 1136 New Order.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2192 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1136 New Order.exe 2452 New Order.exe 2452 New Order.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1136 New Order.exe Token: SeDebugPrivilege 2452 New Order.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1136 wrote to memory of 2192 1136 New Order.exe 30 PID 1136 wrote to memory of 2192 1136 New Order.exe 30 PID 1136 wrote to memory of 2192 1136 New Order.exe 30 PID 1136 wrote to memory of 2192 1136 New Order.exe 30 PID 1136 wrote to memory of 2452 1136 New Order.exe 32 PID 1136 wrote to memory of 2452 1136 New Order.exe 32 PID 1136 wrote to memory of 2452 1136 New Order.exe 32 PID 1136 wrote to memory of 2452 1136 New Order.exe 32 PID 1136 wrote to memory of 2452 1136 New Order.exe 32 PID 1136 wrote to memory of 2452 1136 New Order.exe 32 PID 1136 wrote to memory of 2452 1136 New Order.exe 32 PID 1136 wrote to memory of 2452 1136 New Order.exe 32 PID 1136 wrote to memory of 2452 1136 New Order.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cqOiTcuUlePuHp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE58E.tmp"2⤵
- Creates scheduled task(s)
PID:2192
-
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD533f506c159ccf4f1ee37e51b456b763f
SHA1044658471e0645cca8a3f3ebb0de676286f8ca32
SHA256fdb809ed5c1a93c674a166934f78b1b2767324bcf94609d81b18328d9a8cb712
SHA512ef922fec5437fdafccbe4e09d09fd88e7e359a26d6d7cbb2242e75b13db1063c3c3533656fb7423fcc83e1b3ba964e0b0e4ae0ceb0db5672560dd848f2823c8d