Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
22/08/2023, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe
Resource
win7-20230712-en
General
-
Target
1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe
-
Size
1.2MB
-
MD5
cb518d2222f26fb28b4e42289aa66932
-
SHA1
70281ad83660ee08f6404f2c583a0f921e6ce5b4
-
SHA256
1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e
-
SHA512
544f47e6f451cb36ccd46ee8a7d562c1cca755981e1e7016f7151c01f4722fae1dfcf96d851fef659f3f4ec38547a49a68baf61179f90e0800fdf86515fb8a71
-
SSDEEP
24576:9kF4MQb/sZnXRb7cFsC2nwHCcUzuzxRvL:9Bsb7cF8uCcGQjL
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral1/memory/2680-57-0x0000000010000000-0x0000000010024000-memory.dmp family_blackmoon behavioral1/memory/2680-68-0x0000000010000000-0x0000000010024000-memory.dmp family_blackmoon -
Loads dropped DLL 1 IoCs
pid Process 2680 1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe -
resource yara_rule behavioral1/memory/2680-54-0x00000000002D0000-0x00000000002DB000-memory.dmp upx behavioral1/memory/2680-55-0x00000000002D0000-0x00000000002DB000-memory.dmp upx behavioral1/memory/2680-57-0x0000000010000000-0x0000000010024000-memory.dmp upx behavioral1/memory/2680-67-0x00000000002D0000-0x00000000002DB000-memory.dmp upx behavioral1/memory/2680-68-0x0000000010000000-0x0000000010024000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2680 1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe 2680 1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2680 1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2680 1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe 2680 1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2836 2680 1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe 28 PID 2680 wrote to memory of 2836 2680 1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe 28 PID 2680 wrote to memory of 2836 2680 1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe 28 PID 2680 wrote to memory of 2836 2680 1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe 28 PID 2836 wrote to memory of 3028 2836 cmd.exe 30 PID 2836 wrote to memory of 3028 2836 cmd.exe 30 PID 2836 wrote to memory of 3028 2836 cmd.exe 30 PID 2836 wrote to memory of 3028 2836 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe"C:\Users\Admin\AppData\Local\Temp\1ef34d1751487dab1f7789be86083a10bb28b2760b0d1efad3e65ab95d78eb7e.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.execmd.exe /c route print -42⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\ROUTE.EXEroute print -43⤵PID:3028
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD5678554e4ee9fe69d09ea1d1f93944bdc
SHA1a74694add4e98c8e47b85d4d398ca28eff486225
SHA256d6a56ce2364729210764cc90b8b7e0347c6ff722a2481ea190dd68a6c49dfa56
SHA51209b5e43717cc4a1956e994100473aac116e59e9229a6e9670cadf795185a27e5d7dba84192d1991f325959fc7371460eded76a6bf1512e71afb17a8439a79871