Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 15:41 UTC
Static task
static1
Behavioral task
behavioral1
Sample
dda901fe686bd96e8b563ae189d5a043.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
dda901fe686bd96e8b563ae189d5a043.exe
Resource
win10v2004-20231215-en
General
-
Target
dda901fe686bd96e8b563ae189d5a043.exe
-
Size
8.3MB
-
MD5
dda901fe686bd96e8b563ae189d5a043
-
SHA1
e54bcd2a20e11802ffcd34a6d2f7bae025eba757
-
SHA256
db05884a860b9c355c9908f593ea8defa65e17e0d75ebac77c7305641c81f012
-
SHA512
7c3d753d60ff3e2c0888624a6090f1e9cf769dc172530329be9242dfc628163941b66d49d38c2b0e75b7e0a5ed204ce15b5d0a9cff495e87424fdaa6402d78be
-
SSDEEP
49152:EQFRHrmQG+yrV2BQFRHrmQG+yGrmQlQG+yrV2BQFRHrmQG+2QG+yGrmQlQG+yrV/:EcKycKjQycKbjQy2cKbjQI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2508 mnvfqk.exe -
Loads dropped DLL 2 IoCs
pid Process 1680 dda901fe686bd96e8b563ae189d5a043.exe 1680 dda901fe686bd96e8b563ae189d5a043.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main mnvfqk.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2508 mnvfqk.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2508 mnvfqk.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2508 mnvfqk.exe 2508 mnvfqk.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2508 1680 dda901fe686bd96e8b563ae189d5a043.exe 16 PID 1680 wrote to memory of 2508 1680 dda901fe686bd96e8b563ae189d5a043.exe 16 PID 1680 wrote to memory of 2508 1680 dda901fe686bd96e8b563ae189d5a043.exe 16 PID 1680 wrote to memory of 2508 1680 dda901fe686bd96e8b563ae189d5a043.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\dda901fe686bd96e8b563ae189d5a043.exe"C:\Users\Admin\AppData\Local\Temp\dda901fe686bd96e8b563ae189d5a043.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\mnvfqk.exeC:\Users\Admin\AppData\Local\Temp\mnvfqk.exe -run C:\Users\Admin\AppData\Local\Temp\dda901fe686bd96e8b563ae189d5a043.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
161KB
MD55a60a7e2b60fc1b017a377a4579872b4
SHA179a76153f41c86c7db795c6f6b680841e66c03d5
SHA25606925d5acb984bd36462dd43641d4dd76ee7a54d11af5643247bcfece24d5e3e
SHA5123991201e7007808e85c5c36e8f1cf426d040271ff4e4332ad478e73551e8e82a9442ed3fe3989fc7b15f2325b668a33c7320b275d44ffbb38e077b42afa6d7a5
-
Filesize
65KB
MD569fa1432bf46a04c95eec197577dc663
SHA17880999290f2a3cdbe7a2cfa09a9d3e620ddc580
SHA25604740ecbaed1d51f29a3bff8bd49f4f215e3b1691faff4fbdb2b4a0b3501fb15
SHA512dd589014b2c2e80ba4eba97d348e0be990d3b6b1c52c2a5e053ebd464ab4459400f623519c08cab42e2a71524d3808b8621df91ce6bf39d406c8e6cd8037a7b6
-
Filesize
86KB
MD573905a3aef4b7583bc27fec2fc555e99
SHA119d79d009f7398d771fce0a21d8f042c3b0cd0b0
SHA256447787783cf60de6bc8a991ae2fd304c1b9add4cc71c695a9cc58dc426776206
SHA512be48cac52cf3bd4489449521c7dc933c85ff0cf3f39971eadbd8f60d8e318f1f1a0c146d2766e17883bd46656d429e34b5b20b34755eb1b5511fb8c9b75f7860
-
Filesize
50KB
MD54ab419e755a22876937934b150259428
SHA11e2bf4cb7772a4961df86b32bb343a1b7e19f573
SHA25631d692f0833a4b5b092bba51bfe313c695934bf36e1f2a3cd3be9e9f51197d34
SHA5128a4eac2db807bb9c0eb6f9a6b32699da3e0a01a864816824902a2e8ef806bb7d0cbca5f185fc116c252222a07dbc0ffd6e9a9d1d1fbfcb95a4198880a56f2a92
-
Filesize
29KB
MD5537c1c45458196e526e713169623e63a
SHA13ff3ec4f15b502b4ccb71b237b6a0f731a272363
SHA25607a5cf790f161eba9e0f258bce92bb4d1f78f8b0e8c4349e2427aa6ee303af38
SHA5127cebc07ee1e2bb5e011b0820786bdbc7ce8e7ce643571e23fa7974d85d513661d3bb62a42d82efe49b5eefd7e0853197ea5f360dfd0a46e1821e6ea31b830376