Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 04:12
Static task
static1
Behavioral task
behavioral1
Sample
614c4284526d0d7d8c71a4ba1336398d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
614c4284526d0d7d8c71a4ba1336398d.exe
Resource
win10v2004-20231215-en
General
-
Target
614c4284526d0d7d8c71a4ba1336398d.exe
-
Size
27.1MB
-
MD5
614c4284526d0d7d8c71a4ba1336398d
-
SHA1
056c44900027275fa6b8761a9349c3cdbd829698
-
SHA256
128abe79834296e1a6b3572d3e5728ba0f1196b24bffbb52218ea0503f044cf8
-
SHA512
3aeb0c6cf59c5102a1690ce7e378b3fd51efb67c749e433e178a3c7cc7a5825cb2e092d949bbee0e9b47e3e52fe61432f77050b93d6ec1eb3d7fe73d054b8379
-
SSDEEP
98304:EcKUh+UMh+2Mh+PMh+Y+1+PMh+Y5PMh+Y+1+Mh+PMh+Y+1+PMh+Y5PMh+Y+d:Eu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2508 yen.exe -
Loads dropped DLL 2 IoCs
pid Process 2876 614c4284526d0d7d8c71a4ba1336398d.exe 2876 614c4284526d0d7d8c71a4ba1336398d.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main yen.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2508 yen.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2508 yen.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2508 yen.exe 2508 yen.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2508 2876 614c4284526d0d7d8c71a4ba1336398d.exe 28 PID 2876 wrote to memory of 2508 2876 614c4284526d0d7d8c71a4ba1336398d.exe 28 PID 2876 wrote to memory of 2508 2876 614c4284526d0d7d8c71a4ba1336398d.exe 28 PID 2876 wrote to memory of 2508 2876 614c4284526d0d7d8c71a4ba1336398d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\614c4284526d0d7d8c71a4ba1336398d.exe"C:\Users\Admin\AppData\Local\Temp\614c4284526d0d7d8c71a4ba1336398d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\yen.exeC:\Users\Admin\AppData\Local\Temp\yen.exe -run C:\Users\Admin\AppData\Local\Temp\614c4284526d0d7d8c71a4ba1336398d.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD525666ef183ae41adee819d1d27e83c54
SHA1e97e90e5ac190e10dceb8c4bf06d633a6471d5a9
SHA256e04b361da7cea676be4fa035bfaf44b7f9996322b70e4bbdd7a6c017e3a2c7ac
SHA5120680f9ad93842f908b3aa512b894a3145e18099509689b01e8a397b392fa686e2cdc6e443cc5caef8e0ab78b3708ac43f86e54da46c1ebe32e52d21f3f25ffff
-
Filesize
136KB
MD59bb1b9d9c4d93546f2f5f936ccce7b12
SHA102c475a0524d7a0a9e0b23bcba8a059cb8b0848f
SHA25692e55c72b9eae96ee55df86aaf3f3157826f5e82eb8ddcbffe35aa6f89fb575f
SHA51260de425314650b8d9e55de24eee23d991fa89d710490cb83e7323ee1a603f0590a0912ff5a4b8a762c60138b04736a5297f20b6592e9d37f191fb168be694ff8
-
Filesize
2KB
MD58bf63369d8d26214342cb6d6f5bec44c
SHA10f8804fe3b0241d40c0f7fcabf88fa0e08cbad04
SHA256cb4cc8e8e9a38476c57735ea5ea955d951f46a8ef02305f5dd542be650f6c0a7
SHA512853c3f68525382646c78a25bbc3dc46db25937ff766b057f7a7e4e2eb17608f3892e0342277f306ec58110ecfff0b7d502e07be8473c1715cadc210c58eabad9
-
Filesize
75KB
MD5f73100cb16cc64fcd265e1ff320da728
SHA179e36d62f77778a130cbf93501e4d7ea366275db
SHA2569292bf3f24e20556f84c1ee2dcf84a82c74815f18ca03999219a3d8eb5e5d9a6
SHA512c9dbfff1a52fd1894c0022afcde46e95a663939c390e082ab86a33fd6ed37cce531346ce446ba79b546cbf82d55b19f3dd2e7c6554d88e3c4780f12e54f1b87d
-
Filesize
48KB
MD57369ed06f79f387a6ede1bcb247db382
SHA120b6d62dd9aa48bc2740dca67ac4b4736bef499f
SHA25632531eb6a3361a71fea9d2137f98b307eb2e9d45db74665cc7c4e8f7d20be8a3
SHA512664d70f9033eac811c8c5979e66b1325a28587a21e5cc6141fe164d511d90092712a7acee13ee2a84f267a81269cc618aad1a469f05cc0fb26940c06913f0d62