Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 19:36
Static task
static1
Behavioral task
behavioral1
Sample
0df9635533f46079ded4e2f41aa75180.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0df9635533f46079ded4e2f41aa75180.exe
Resource
win10v2004-20231215-en
General
-
Target
0df9635533f46079ded4e2f41aa75180.exe
-
Size
552KB
-
MD5
0df9635533f46079ded4e2f41aa75180
-
SHA1
e84dc00c265fd2596160d92db35afcabb9fd721c
-
SHA256
e59e1c288a445ddde1bd826470bd262b5d351ba83ea9d82ad8329157e3fcc37e
-
SHA512
eb4d28951fd98cd4713461beddd1ab1a44e2abefb11a29deea2d1977fbdaabc4b1b1a6b5d1bd5091a37d1ec8002f331797d348ea19a6594097f599bc08dd2f67
-
SSDEEP
12288:tPHFsiMMnMMMMMG7ydZOtY+KVb4zgR3Qt3Q3CX1LA6T:tNsiMMnMMMMMG7EZ2Y1Vb4zr4g1VT
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1888 iCEyocHtffAu.exe -
Loads dropped DLL 1 IoCs
pid Process 2356 0df9635533f46079ded4e2f41aa75180.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\iCEyocHtffAu = "C:\\ProgramData\\iCEyocHtffAu.exe" 0df9635533f46079ded4e2f41aa75180.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Download 0df9635533f46079ded4e2f41aa75180.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" 0df9635533f46079ded4e2f41aa75180.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2356 0df9635533f46079ded4e2f41aa75180.exe 2356 0df9635533f46079ded4e2f41aa75180.exe 1888 iCEyocHtffAu.exe 1888 iCEyocHtffAu.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2356 0df9635533f46079ded4e2f41aa75180.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 1888 2356 0df9635533f46079ded4e2f41aa75180.exe 1 PID 2356 wrote to memory of 1888 2356 0df9635533f46079ded4e2f41aa75180.exe 1 PID 2356 wrote to memory of 1888 2356 0df9635533f46079ded4e2f41aa75180.exe 1 PID 2356 wrote to memory of 1888 2356 0df9635533f46079ded4e2f41aa75180.exe 1 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 0df9635533f46079ded4e2f41aa75180.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" 0df9635533f46079ded4e2f41aa75180.exe
Processes
-
C:\ProgramData\iCEyocHtffAu.exe"C:\ProgramData\iCEyocHtffAu.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1888
-
C:\Users\Admin\AppData\Local\Temp\0df9635533f46079ded4e2f41aa75180.exe"C:\Users\Admin\AppData\Local\Temp\0df9635533f46079ded4e2f41aa75180.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
552KB
MD50df9635533f46079ded4e2f41aa75180
SHA1e84dc00c265fd2596160d92db35afcabb9fd721c
SHA256e59e1c288a445ddde1bd826470bd262b5d351ba83ea9d82ad8329157e3fcc37e
SHA512eb4d28951fd98cd4713461beddd1ab1a44e2abefb11a29deea2d1977fbdaabc4b1b1a6b5d1bd5091a37d1ec8002f331797d348ea19a6594097f599bc08dd2f67