Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 22:02
Behavioral task
behavioral1
Sample
145c4f18fca937a1671ba501fac811d3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
145c4f18fca937a1671ba501fac811d3.exe
Resource
win10v2004-20231215-en
General
-
Target
145c4f18fca937a1671ba501fac811d3.exe
-
Size
33KB
-
MD5
145c4f18fca937a1671ba501fac811d3
-
SHA1
3c2bda88e40f46266caa5cf3916203f294849fbe
-
SHA256
bdbefbe7d2fc2291193b22107e2ab30cfea59b700abb497161cdca24458acc16
-
SHA512
da414d77958d471f0c80f0519f45e3cf235b31bbf20d2bfeb8ef93b135e9db753b1912924f8afc5ae325c2fbe900ddeb626f3257cf6d1cdfd3e8519c66e725d0
-
SSDEEP
768:VcBxHptDnQLKCbC4Ys5sHCsPMasRCHVMZnDR4P6OIDTkZTv5YIfi:Vmxrb2KCOVZi2MvDR6qTkZrKYi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3044 taskmngr32.exe -
Loads dropped DLL 2 IoCs
pid Process 2076 145c4f18fca937a1671ba501fac811d3.exe 2076 145c4f18fca937a1671ba501fac811d3.exe -
resource yara_rule behavioral1/memory/2076-1-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2076-4-0x0000000000730000-0x0000000000763000-memory.dmp upx behavioral1/files/0x0009000000012262-3.dat upx behavioral1/memory/3044-13-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/2076-11-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/3044-15-0x0000000000400000-0x0000000000433000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Task Manager Win32 = "C:\\Windows\\SysWOW64\\taskmngr32.exe" taskmngr32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\taskmngr32.exe 145c4f18fca937a1671ba501fac811d3.exe File opened for modification C:\Windows\SysWOW64\taskmngr32.exe 145c4f18fca937a1671ba501fac811d3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2076 wrote to memory of 3044 2076 145c4f18fca937a1671ba501fac811d3.exe 18 PID 2076 wrote to memory of 3044 2076 145c4f18fca937a1671ba501fac811d3.exe 18 PID 2076 wrote to memory of 3044 2076 145c4f18fca937a1671ba501fac811d3.exe 18 PID 2076 wrote to memory of 3044 2076 145c4f18fca937a1671ba501fac811d3.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\145c4f18fca937a1671ba501fac811d3.exe"C:\Users\Admin\AppData\Local\Temp\145c4f18fca937a1671ba501fac811d3.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\taskmngr32.exe"C:\Windows\system32\taskmngr32.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5145c4f18fca937a1671ba501fac811d3
SHA13c2bda88e40f46266caa5cf3916203f294849fbe
SHA256bdbefbe7d2fc2291193b22107e2ab30cfea59b700abb497161cdca24458acc16
SHA512da414d77958d471f0c80f0519f45e3cf235b31bbf20d2bfeb8ef93b135e9db753b1912924f8afc5ae325c2fbe900ddeb626f3257cf6d1cdfd3e8519c66e725d0