Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 16:48

General

  • Target

    06914834645d9ab3058300de4c756954.exe

  • Size

    410KB

  • MD5

    06914834645d9ab3058300de4c756954

  • SHA1

    437546390ab6be7ab887e82148ba8b923bedd844

  • SHA256

    50c6eeab65b9c35d55dde8ba5cca1eaba4091d0a5611a353f9561e3e37453e67

  • SHA512

    08869a715d99a8034ee9e473c0c56f8fa4d35afbb67467a4d27ffd9d34f7d32f87a2b1f1141657ce7de27888fdca477af3d4756d6e5799d5dd27b5acbe2ff953

  • SSDEEP

    12288:3w06cUYTczdkibnD3WUgFooE3cVkO3rHGa6vSoW1:7TUHkibDGencVnHq6f

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06914834645d9ab3058300de4c756954.exe
    "C:\Users\Admin\AppData\Local\Temp\06914834645d9ab3058300de4c756954.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2312
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        3⤵
          PID:2704
        • C:\Users\Admin\AppData\Local\Temp\System\lsn.exe
          "C:\Users\Admin\AppData\Local\Temp\System\lsn.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2664
          • C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe
            "C:\Users\Admin\AppData\Local\Temp\System\spolsv.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2568
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
              C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
              5⤵
                PID:596

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

        Filesize

        70B

        MD5

        673c630c339470fb63850411fc5af025

        SHA1

        938da03d56e1c206abc0fb7d729855a0a877a103

        SHA256

        64b7ba818f2ac7e79037f57649b441d293bde5e213eae6289e1d16b753ecae70

        SHA512

        8f51561e75a5acc3bff8a8006fc0934b55884255b4ffd6a43b028f4d1379f74694464a614da94195b3a240abf1756a83cdb399efcef209b75ee37789743a0713

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

        Filesize

        410KB

        MD5

        06914834645d9ab3058300de4c756954

        SHA1

        437546390ab6be7ab887e82148ba8b923bedd844

        SHA256

        50c6eeab65b9c35d55dde8ba5cca1eaba4091d0a5611a353f9561e3e37453e67

        SHA512

        08869a715d99a8034ee9e473c0c56f8fa4d35afbb67467a4d27ffd9d34f7d32f87a2b1f1141657ce7de27888fdca477af3d4756d6e5799d5dd27b5acbe2ff953

      • \Users\Admin\AppData\Local\Temp\System\lsn.exe

        Filesize

        24KB

        MD5

        0aa7e4dd12b1fc4d899bb86b0fd56233

        SHA1

        3bbd901ecc48959847deb145da3f3af6dc194afd

        SHA256

        d1267fc8e53b1cb8cda98eec93daf21ded66ba6ac9c05b0b7315444d459384e9

        SHA512

        2f2cd1892ab79a9dba46d1c1d848cd85ec876968b07316ccbda275b88960dc1718da7e4d433c88d0a52d2637bb5c99eda1135529f956e4a54c14f09bbc3f8e11

      • \Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

        Filesize

        256KB

        MD5

        e700070748fcbe30d4e9d3ed51273f9d

        SHA1

        dfe8247dab82b1a2c765193bfde8702cc3f7f0e2

        SHA256

        42dc0bbfbff3c9af5192e22386e0e1ab2a5a4bea3c5cba0787405b81935778b5

        SHA512

        fd77e6d4283534fa34f72306caa75675d328271d018a6ea7d7a1d7c85b0af6cb9d8cdb0c51f2f668226ab2f09852f87cbede049e8b1b52c47d97de6978a41753

      • memory/596-84-0x0000000000401000-0x0000000000456000-memory.dmp

        Filesize

        340KB

      • memory/2024-1-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2024-2-0x0000000002060000-0x00000000020A0000-memory.dmp

        Filesize

        256KB

      • memory/2024-14-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2024-0-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2312-15-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2312-87-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2312-17-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2312-16-0x0000000002030000-0x0000000002070000-memory.dmp

        Filesize

        256KB

      • memory/2312-85-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2312-86-0x0000000002030000-0x0000000002070000-memory.dmp

        Filesize

        256KB

      • memory/2568-67-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2568-91-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2568-92-0x0000000002060000-0x00000000020A0000-memory.dmp

        Filesize

        256KB

      • memory/2568-64-0x0000000002060000-0x00000000020A0000-memory.dmp

        Filesize

        256KB

      • memory/2568-62-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2664-89-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2664-90-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2664-54-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2664-53-0x0000000074CD0000-0x000000007527B000-memory.dmp

        Filesize

        5.7MB

      • memory/2704-23-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-46-0x0000000000250000-0x0000000000251000-memory.dmp

        Filesize

        4KB

      • memory/2704-45-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-44-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-41-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-43-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-39-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-38-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-37-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2704-33-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-88-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-31-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-29-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-27-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB

      • memory/2704-25-0x0000000000400000-0x0000000000466000-memory.dmp

        Filesize

        408KB