Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 07:52
Static task
static1
Behavioral task
behavioral1
Sample
102e63dc3480222e7ed70b927311d085.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
102e63dc3480222e7ed70b927311d085.exe
Resource
win10v2004-20231215-en
General
-
Target
102e63dc3480222e7ed70b927311d085.exe
-
Size
284KB
-
MD5
102e63dc3480222e7ed70b927311d085
-
SHA1
84df911dae0f57a3cd07a909c8ce4dfaaef1967a
-
SHA256
15f88c60203d64573fbc5f92c15c3f82858195b5646ad7dd0800008ca7377719
-
SHA512
2889b00e654e571bf341bc408d7e183fed741d86e2e1ebecd96c53f65013abc50afcd9d71162cdfd956120919cf83f1f4bf1d675e1ec0c372bf64ed2a82eeec3
-
SSDEEP
6144:toRoGcgrz/7ThnOo26kztF/GwFBld5Z8aDyxXgsvf:tlGcqz/7ThOo2681NvdrDO
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3000 102e63dc3480222e7ed70b927311d085.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3000 wrote to memory of 1536 3000 102e63dc3480222e7ed70b927311d085.exe 28 PID 3000 wrote to memory of 1536 3000 102e63dc3480222e7ed70b927311d085.exe 28 PID 3000 wrote to memory of 1536 3000 102e63dc3480222e7ed70b927311d085.exe 28 PID 3000 wrote to memory of 1536 3000 102e63dc3480222e7ed70b927311d085.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\102e63dc3480222e7ed70b927311d085.exe"C:\Users\Admin\AppData\Local\Temp\102e63dc3480222e7ed70b927311d085.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" c:\1b9e8de5-4a44-4f59-b732-7caf50140d1c\start.hta2⤵
- Modifies Internet Explorer settings
PID:1536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD583c69994da6f42e046a437e0fa7c7ddf
SHA180623cb6cfaf33c5d5041db0b9f10d4518da4971
SHA256fd69b98d502cd75939020d7768399ff9db9a173a0b15e2e239a60793b1361140
SHA512235cbd534d4953ec82209b0d3ce00dd491d390e9c9e67a2165c6a1e2fc6d5faf091307b60ef5c16a7d28cc70865f3ce63b8148b32d66c140973b569f37cadb92
-
Filesize
1KB
MD5e88ebd85dd56110ac6ea93fe0922988e
SHA1684a31d864d33ff736234c41ac4e8d2c7f90d5ae
SHA256379d1b0948f8e06366e7bcd197c848c0cc783787792f2224f98c16b974d920eb
SHA512211b0760c9a887fc13c479617daeb6d5b6ee0ccd06c214967abd3e1f14204f72e34a6dd5eb778a9fc6ac7fc8bd63bdef80b347abab97becda16924cb3e164dc7
-
Filesize
1KB
MD5db4ada697fa7a0e215281533d52578e9
SHA1fb755ea8371edf5065dc53e21eb413603f9eba7f
SHA256f949fd6ca734830572128b4348dfd039419140c7ef501d80773f71ca3f0ed78c
SHA5129ba1d2658785dd3c88b4399132f8330dc58872235e19ca9854b0e453d8cc7a58de0c8be84da376a72b5851073f531c95b2c6afa84f43053561ca8e6751d6e2f3