Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 20:25
Static task
static1
Behavioral task
behavioral1
Sample
10c546472c8671e8bcb8322a20132396.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
10c546472c8671e8bcb8322a20132396.exe
Resource
win10v2004-20231215-en
General
-
Target
10c546472c8671e8bcb8322a20132396.exe
-
Size
142KB
-
MD5
10c546472c8671e8bcb8322a20132396
-
SHA1
938624bd24157386e1b1ac57a18208ddbc58906d
-
SHA256
a313a6134e267c1c3e7c5f9790dcc0fa07ac7105977297051373b70c2de22283
-
SHA512
f67390449a01158327297342fb1bb2cd27c4f520dac6100adbb492f2e1bd94ade9dcbbe49767ba8c0f7d53b2f20efea5f7f05bcd58bc503752ba3fc7a57bdda5
-
SSDEEP
3072:89NzEfwf32SvZZ+0UxVG/PedD2v+V1b4NMeMxEcGgwXUE9CRy0gO4t:89eYfJvzB6U/qpcMeCEC1yDX
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 10c546472c8671e8bcb8322a20132396.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Public\HEX-5823-6893-6818\vlcproc.exe = "C:\\Users\\Public\\HEX-5823-6893-6818\\vlcproc.exe:*:Enabled:Java Update Manager" 10c546472c8671e8bcb8322a20132396.exe -
Executes dropped EXE 3 IoCs
pid Process 2848 vlcproc.exe 2624 vlcproc.exe 2840 vlcproc.exe -
Loads dropped DLL 2 IoCs
pid Process 2064 10c546472c8671e8bcb8322a20132396.exe 2064 10c546472c8671e8bcb8322a20132396.exe -
resource yara_rule behavioral1/memory/2288-4-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2288-11-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2288-23-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2288-8-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2288-7-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2624-65-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2624-58-0x0000000000400000-0x0000000000418000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\Java Update Manager = "C:\\Users\\Public\\HEX-5823-6893-6818\\vlcproc.exe" 10c546472c8671e8bcb8322a20132396.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2540 set thread context of 2288 2540 10c546472c8671e8bcb8322a20132396.exe 28 PID 2288 set thread context of 2064 2288 10c546472c8671e8bcb8322a20132396.exe 29 PID 2848 set thread context of 2624 2848 vlcproc.exe 31 PID 2624 set thread context of 2840 2624 vlcproc.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2540 10c546472c8671e8bcb8322a20132396.exe 2288 10c546472c8671e8bcb8322a20132396.exe 2848 vlcproc.exe 2624 vlcproc.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2288 2540 10c546472c8671e8bcb8322a20132396.exe 28 PID 2540 wrote to memory of 2288 2540 10c546472c8671e8bcb8322a20132396.exe 28 PID 2540 wrote to memory of 2288 2540 10c546472c8671e8bcb8322a20132396.exe 28 PID 2540 wrote to memory of 2288 2540 10c546472c8671e8bcb8322a20132396.exe 28 PID 2540 wrote to memory of 2288 2540 10c546472c8671e8bcb8322a20132396.exe 28 PID 2540 wrote to memory of 2288 2540 10c546472c8671e8bcb8322a20132396.exe 28 PID 2540 wrote to memory of 2288 2540 10c546472c8671e8bcb8322a20132396.exe 28 PID 2540 wrote to memory of 2288 2540 10c546472c8671e8bcb8322a20132396.exe 28 PID 2540 wrote to memory of 2288 2540 10c546472c8671e8bcb8322a20132396.exe 28 PID 2288 wrote to memory of 2064 2288 10c546472c8671e8bcb8322a20132396.exe 29 PID 2288 wrote to memory of 2064 2288 10c546472c8671e8bcb8322a20132396.exe 29 PID 2288 wrote to memory of 2064 2288 10c546472c8671e8bcb8322a20132396.exe 29 PID 2288 wrote to memory of 2064 2288 10c546472c8671e8bcb8322a20132396.exe 29 PID 2288 wrote to memory of 2064 2288 10c546472c8671e8bcb8322a20132396.exe 29 PID 2288 wrote to memory of 2064 2288 10c546472c8671e8bcb8322a20132396.exe 29 PID 2288 wrote to memory of 2064 2288 10c546472c8671e8bcb8322a20132396.exe 29 PID 2288 wrote to memory of 2064 2288 10c546472c8671e8bcb8322a20132396.exe 29 PID 2288 wrote to memory of 2064 2288 10c546472c8671e8bcb8322a20132396.exe 29 PID 2064 wrote to memory of 2848 2064 10c546472c8671e8bcb8322a20132396.exe 30 PID 2064 wrote to memory of 2848 2064 10c546472c8671e8bcb8322a20132396.exe 30 PID 2064 wrote to memory of 2848 2064 10c546472c8671e8bcb8322a20132396.exe 30 PID 2064 wrote to memory of 2848 2064 10c546472c8671e8bcb8322a20132396.exe 30 PID 2848 wrote to memory of 2624 2848 vlcproc.exe 31 PID 2848 wrote to memory of 2624 2848 vlcproc.exe 31 PID 2848 wrote to memory of 2624 2848 vlcproc.exe 31 PID 2848 wrote to memory of 2624 2848 vlcproc.exe 31 PID 2848 wrote to memory of 2624 2848 vlcproc.exe 31 PID 2848 wrote to memory of 2624 2848 vlcproc.exe 31 PID 2848 wrote to memory of 2624 2848 vlcproc.exe 31 PID 2848 wrote to memory of 2624 2848 vlcproc.exe 31 PID 2848 wrote to memory of 2624 2848 vlcproc.exe 31 PID 2624 wrote to memory of 2840 2624 vlcproc.exe 32 PID 2624 wrote to memory of 2840 2624 vlcproc.exe 32 PID 2624 wrote to memory of 2840 2624 vlcproc.exe 32 PID 2624 wrote to memory of 2840 2624 vlcproc.exe 32 PID 2624 wrote to memory of 2840 2624 vlcproc.exe 32 PID 2624 wrote to memory of 2840 2624 vlcproc.exe 32 PID 2624 wrote to memory of 2840 2624 vlcproc.exe 32 PID 2624 wrote to memory of 2840 2624 vlcproc.exe 32 PID 2624 wrote to memory of 2840 2624 vlcproc.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\10c546472c8671e8bcb8322a20132396.exe"C:\Users\Admin\AppData\Local\Temp\10c546472c8671e8bcb8322a20132396.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\10c546472c8671e8bcb8322a20132396.exeC:\Users\Admin\AppData\Local\Temp\10c546472c8671e8bcb8322a20132396.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\10c546472c8671e8bcb8322a20132396.exe
- Modifies firewall policy service
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Public\HEX-5823-6893-6818\vlcproc.exe"C:\Users\Public\HEX-5823-6893-6818\vlcproc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Public\HEX-5823-6893-6818\vlcproc.exeC:\Users\Public\HEX-5823-6893-6818\vlcproc.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Public\HEX-5823-6893-6818\vlcproc.exe
- Executes dropped EXE
PID:2840
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
142KB
MD510c546472c8671e8bcb8322a20132396
SHA1938624bd24157386e1b1ac57a18208ddbc58906d
SHA256a313a6134e267c1c3e7c5f9790dcc0fa07ac7105977297051373b70c2de22283
SHA512f67390449a01158327297342fb1bb2cd27c4f520dac6100adbb492f2e1bd94ade9dcbbe49767ba8c0f7d53b2f20efea5f7f05bcd58bc503752ba3fc7a57bdda5