Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 12:02
Static task
static1
Behavioral task
behavioral1
Sample
499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe
Resource
win10v2004-20230915-en
General
-
Target
499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe
-
Size
198KB
-
MD5
2c8e1985e6d94736175ad40b99b5c834
-
SHA1
ae275f822db435ade867d25c60a8edbdf0065c05
-
SHA256
499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d
-
SHA512
85a6de7fd3f0804541cfe1a8024c7cf1a6ab3647c2502ad253490ce8e2f5df07a06745a1f877ee3f7b8c92754c8f8fcc360a86b53deaa64b3e88f506073d69aa
-
SSDEEP
6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOs:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXp
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2612 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2584 rwmhost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\rwmhost.exe 499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe File opened for modification C:\Windows\Debug\rwmhost.exe 499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rwmhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rwmhost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1020 499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1020 wrote to memory of 2612 1020 499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe 29 PID 1020 wrote to memory of 2612 1020 499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe 29 PID 1020 wrote to memory of 2612 1020 499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe 29 PID 1020 wrote to memory of 2612 1020 499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe"C:\Users\Admin\AppData\Local\Temp\499573f6ee88bc297a153dd1efa9860cd0a418c873b6cc3ccda469d82dea302d.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\499573~1.EXE > nul2⤵
- Deletes itself
PID:2612
-
-
C:\Windows\Debug\rwmhost.exeC:\Windows\Debug\rwmhost.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198KB
MD50160f403f0ad19041194362a00287ef6
SHA155fb71a255ff9027fba099334947ba602680eb86
SHA25656ba1d1974b05876af4fb00a1ac64b95c2fc2b0d50be4b0b4d1ffe82dab0ec37
SHA5127ac05190666faf76177af23274051c6a95c16de408414327e08efd172b5ca2d45fa5aeb2bcee4322d2becb638e06fcdcb42766371df00062e03a4142b253e035
-
Filesize
198KB
MD50160f403f0ad19041194362a00287ef6
SHA155fb71a255ff9027fba099334947ba602680eb86
SHA25656ba1d1974b05876af4fb00a1ac64b95c2fc2b0d50be4b0b4d1ffe82dab0ec37
SHA5127ac05190666faf76177af23274051c6a95c16de408414327e08efd172b5ca2d45fa5aeb2bcee4322d2becb638e06fcdcb42766371df00062e03a4142b253e035