Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2ee96582f8...fc.exe

windows7-x64

7

2ee96582f8...fc.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    154s
  • max time network
    164s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2023, 18:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2ee96582f8901cf86bbbfb191dfaec0b8389a5b3059fa32d1757fc5e6ad625fc.exe

  • Size

    1.1MB

  • MD5

    703cb6483aac00afe66453d67698964e

  • SHA1

    d07cd417c7756483d6faa9a64a9681da73d59e16

  • SHA256

    2ee96582f8901cf86bbbfb191dfaec0b8389a5b3059fa32d1757fc5e6ad625fc

  • SHA512

    e160c755969a5f8939d1b463e85924ccf9067779db72aafba13a402d420db85644310abb7e6c0b33f3580a17579c1395247320ed4fd1eaa14ee5cc48ef30333c

  • SSDEEP

    24576:4qg8zeKPja85nd0T9RAN0P30mqym6hzsGoRlG4qqjwg1mRWRux:44zeI/0XqymkulG4qmxmiux

Score
7/10
persistence

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ee96582f8901cf86bbbfb191dfaec0b8389a5b3059fa32d1757fc5e6ad625fc.exe
    "C:\Users\Admin\AppData\Local\Temp\2ee96582f8901cf86bbbfb191dfaec0b8389a5b3059fa32d1757fc5e6ad625fc.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
        PID:2112
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
        2⤵
          PID:2304

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini
        Filesize

        92B

        MD5

        5611518085f0e601b7af262b73ca1e21

        SHA1

        679e284b4e15030b11e9fcab9e54090f6128c6c2

        SHA256

        8e59e3dc5427519534af0cfb2713d94388d03240f4f6d2c9ec6a13db1d9812ab

        SHA512

        0fc4c396d00386c7942366bab8bf30b59723f4a8b0d5bfe00dbc4a74df13acb68cd6616694a81de199bcd2409ff41b6dcaca931614165deefadd728350c52bcc

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
        Filesize

        753B

        MD5

        10ac1fc5c64c991d40fc528f691e43ac

        SHA1

        a53c77243ae87ce8bd1d8be56d9d6c6fbc50713d

        SHA256

        cd5310560a368e3c322897f18fb37adb5017ef0b7797beab56b37a7e8f82b4e5

        SHA512

        aa67e3670d3e24b662ac638facf6ec3a62ecbaa5e082df7b2fc3b3e52144a7325cc1affc83d2221fba88a5850120e6da48e18035b2ed71feae70abcf95bb0bab

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
        Filesize

        753B

        MD5

        10ac1fc5c64c991d40fc528f691e43ac

        SHA1

        a53c77243ae87ce8bd1d8be56d9d6c6fbc50713d

        SHA256

        cd5310560a368e3c322897f18fb37adb5017ef0b7797beab56b37a7e8f82b4e5

        SHA512

        aa67e3670d3e24b662ac638facf6ec3a62ecbaa5e082df7b2fc3b3e52144a7325cc1affc83d2221fba88a5850120e6da48e18035b2ed71feae70abcf95bb0bab

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        Filesize

        1.1MB

        MD5

        11807cb05618c4b6608f14e2cf4ba3b6

        SHA1

        0b53962ddbd29d004c945f24f7a046c04e307bdf

        SHA256

        040fcd219b68295f9deaf342d66eb34f86714c6be2c35c0c9b235cce191fd46a

        SHA512

        93b0ff78384e9cf55e3ef030f9547be6e24e81c97f8a8179cde5e8566bb8fcd331fe0c7dca0f3ca7e549a6125e302f14c52ab54aaac0c38c405a31f7354863ee

        Download Submit

      • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        Filesize

        1.1MB

        MD5

        11807cb05618c4b6608f14e2cf4ba3b6

        SHA1

        0b53962ddbd29d004c945f24f7a046c04e307bdf

        SHA256

        040fcd219b68295f9deaf342d66eb34f86714c6be2c35c0c9b235cce191fd46a

        SHA512

        93b0ff78384e9cf55e3ef030f9547be6e24e81c97f8a8179cde5e8566bb8fcd331fe0c7dca0f3ca7e549a6125e302f14c52ab54aaac0c38c405a31f7354863ee

        Download Submit

      • \Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
        Filesize

        1.1MB

        MD5

        11807cb05618c4b6608f14e2cf4ba3b6

        SHA1

        0b53962ddbd29d004c945f24f7a046c04e307bdf

        SHA256

        040fcd219b68295f9deaf342d66eb34f86714c6be2c35c0c9b235cce191fd46a

        SHA512

        93b0ff78384e9cf55e3ef030f9547be6e24e81c97f8a8179cde5e8566bb8fcd331fe0c7dca0f3ca7e549a6125e302f14c52ab54aaac0c38c405a31f7354863ee

        Download Submit

      • memory/1896-0-0x0000000000400000-0x0000000000553000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/1896-1-0x0000000000400000-0x0000000000553000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/1896-19-0x00000000003C0000-0x00000000003D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1896-17-0x00000000003C0000-0x00000000003D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1896-21-0x0000000000400000-0x0000000000553000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/1896-22-0x00000000003C0000-0x00000000003D0000-memory.dmp

        Filesize

        64KB

        Download