Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 07:22
Static task
static1
Behavioral task
behavioral1
Sample
0e6d064a2367fc710df5d7783aa9e918.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e6d064a2367fc710df5d7783aa9e918.exe
Resource
win10v2004-20231215-en
General
-
Target
0e6d064a2367fc710df5d7783aa9e918.exe
-
Size
237KB
-
MD5
0e6d064a2367fc710df5d7783aa9e918
-
SHA1
9fd67948f04435bf7a87dfc84c5590b36a6d9f1d
-
SHA256
5b549a718d3f01a3566830660c5bb433a59ae2524bfc7be0d9ab2b43a618c6e7
-
SHA512
94aba068fc77dcfdcfd0b4f3c5e64943cb29b75f21b5b9100aa5e4b7964ee89aca38e5b5aa0d6b80ee2565b142be6187c976b8a63f21f41a1a642205f818a5a4
-
SSDEEP
3072:HwxVMhOC/dTDbq91+mno3t4QZQ3rbTn7kknpLWFccNWwN203C0qEf81ePBxhYNZa:HTfFDbRnOTrbTZpu1N2FhU81ALhYPLzS
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2080 beli.exe 812 beli.exe -
Loads dropped DLL 3 IoCs
pid Process 1792 0e6d064a2367fc710df5d7783aa9e918.exe 1792 0e6d064a2367fc710df5d7783aa9e918.exe 2080 beli.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2080 set thread context of 812 2080 beli.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 812 beli.exe 812 beli.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2276 DllHost.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2080 1792 0e6d064a2367fc710df5d7783aa9e918.exe 28 PID 1792 wrote to memory of 2080 1792 0e6d064a2367fc710df5d7783aa9e918.exe 28 PID 1792 wrote to memory of 2080 1792 0e6d064a2367fc710df5d7783aa9e918.exe 28 PID 1792 wrote to memory of 2080 1792 0e6d064a2367fc710df5d7783aa9e918.exe 28 PID 2080 wrote to memory of 812 2080 beli.exe 29 PID 2080 wrote to memory of 812 2080 beli.exe 29 PID 2080 wrote to memory of 812 2080 beli.exe 29 PID 2080 wrote to memory of 812 2080 beli.exe 29 PID 2080 wrote to memory of 812 2080 beli.exe 29 PID 2080 wrote to memory of 812 2080 beli.exe 29 PID 812 wrote to memory of 1200 812 beli.exe 16 PID 812 wrote to memory of 1200 812 beli.exe 16 PID 812 wrote to memory of 1200 812 beli.exe 16 PID 812 wrote to memory of 1200 812 beli.exe 16
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\0e6d064a2367fc710df5d7783aa9e918.exe"C:\Users\Admin\AppData\Local\Temp\0e6d064a2367fc710df5d7783aa9e918.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\beli.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\beli.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\beli.exeC:\Users\Admin\AppData\Local\Temp\RarSFX0\beli.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:812
-
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:2276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD59d25676d4c96e190562aa4c9d7854849
SHA1f2ceab7fdc8b36dc94574c081b10fa5820df67fe
SHA256897dca7cad3d0b9dc60b68c17e4d77cd15de3fcd96da8c94e6fa63e8fb815a26
SHA512c71a1b405704f043082769525fb8a49f7a29ce3cdb4c03951418ccfa822f5cb5d4fc7361013e26abdbf02a114f28f1a1e6075ff02d87033d24c87b7ce37d8fd1
-
Filesize
64KB
MD5da0869d2d78d5ae73d31988ecb1a4d06
SHA1eef3679cba5046e1d999a5cc3e9379bc26ebc618
SHA256ed683234d4e63791bec26598624c524b1815fc40902300e69da8fdc72c073f1e
SHA512e5b723dfa4fb3346736c82c5412fa2f671216d1675060ed1ee720d2e99f669b2147ec9581f4747f795218feb4a92cd5e75f0ed4c6be8697081bc85a3336531b6