Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
24/08/2023, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20230712-en
General
-
Target
1.exe
-
Size
872KB
-
MD5
c56b5f0201a3b3de53e561fe76912bfd
-
SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417
-
SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
-
SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
SSDEEP
12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
Malware Config
Extracted
darkgate
http://107.181.161.20
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 2476 created 1116 2476 1.exe 14 PID 2488 created 1116 2488 TabTip32.exe 14 -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dbadaba.lnk TabTip32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2476 1.exe 2476 1.exe 2488 TabTip32.exe 2488 TabTip32.exe 1748 SmartTagInstall.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2488 TabTip32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28 PID 2476 wrote to memory of 2488 2476 1.exe 28
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe"C:\Program Files (x86)\Common Files\microsoft shared\ink\TabTip32.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2488
-
-
C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe"C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\SmartTagInstall.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748
-
-
C:\Users\Admin\AppData\Local\Temp\1.exeC:\Users\Admin\AppData\Local\Temp\1.exe 3.au31⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134B
MD545b0c7b9769f142c558502bae6e7fb9a
SHA17dc92c892acd0018ae0041201a1a91a47055ef65
SHA25622429ff2bf212ea5052d66ce0762048796b5867fca0351ddc0ddc522621d6c9b
SHA512b4fa9d798c0152424970b1f681fcf12137632bacab370df57dccb2499311bfc01a8dcdea0cf21b32ff7243b768dfc94dff06c334c2be32dfd4e10b8e4f2f3431
-
Filesize
134B
MD545b0c7b9769f142c558502bae6e7fb9a
SHA17dc92c892acd0018ae0041201a1a91a47055ef65
SHA25622429ff2bf212ea5052d66ce0762048796b5867fca0351ddc0ddc522621d6c9b
SHA512b4fa9d798c0152424970b1f681fcf12137632bacab370df57dccb2499311bfc01a8dcdea0cf21b32ff7243b768dfc94dff06c334c2be32dfd4e10b8e4f2f3431
-
Filesize
776KB
MD55892ff480896da2f5c2e52a8dccb1446
SHA17d89c0b2ed8613f0ea23a2200b9a66d8b316f7af
SHA2561d981f5c19ba3f2be6be51685f211ed80b28fc31dd1de7b7797e09a611e893c5
SHA5126a836325d3f233cd04eca1de36e695f238005066b55d93d6526e90a588466da2812b84407095a7fb19f8e1051b66c04457886a239d481ab48563507eb85c5213