Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 10:51
Behavioral task
behavioral1
Sample
188f6cc8554a4a5906828ef93e7eae03.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
General
-
Target
188f6cc8554a4a5906828ef93e7eae03.exe
-
Size
298KB
-
MD5
188f6cc8554a4a5906828ef93e7eae03
-
SHA1
c634a657a244819b91b69e5343d0005a4d70aa06
-
SHA256
54bc451f7c277e47b7b91817f671d86ac0dab1677cb4897643cad2ab99e44372
-
SHA512
2abcc1fd656f9933e79556aec02bc060d556fe729d995ffa5a6548c341ea4e82e780a59b4276e1a722aefbd97ff12a8c03ba0e6668a7d0e43cb4502d17fe5f09
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYP:v6Wq4aaE6KwyF5L0Y2D1PqLQ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2896 svhost.exe -
resource yara_rule behavioral1/memory/1476-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x000a0000000133a9-4.dat upx behavioral1/memory/2896-6-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x000700000001412c-66.dat upx behavioral1/memory/1476-803-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-1332-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-2395-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-3454-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-4772-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-5839-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-6898-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-7956-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-9279-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-10339-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-11395-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-12452-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-13781-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2896-14835-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\y: svhost.exe -
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2896-6-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1476-803-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-1332-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-2395-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-3454-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-4772-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-5839-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-6898-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-7956-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-9279-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-10339-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-11395-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-12452-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-13781-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2896-14835-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 188f6cc8554a4a5906828ef93e7eae03.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2896 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1476 188f6cc8554a4a5906828ef93e7eae03.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1476 188f6cc8554a4a5906828ef93e7eae03.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 1476 188f6cc8554a4a5906828ef93e7eae03.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe 2896 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1476 wrote to memory of 2896 1476 188f6cc8554a4a5906828ef93e7eae03.exe 28 PID 1476 wrote to memory of 2896 1476 188f6cc8554a4a5906828ef93e7eae03.exe 28 PID 1476 wrote to memory of 2896 1476 188f6cc8554a4a5906828ef93e7eae03.exe 28 PID 1476 wrote to memory of 2896 1476 188f6cc8554a4a5906828ef93e7eae03.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\188f6cc8554a4a5906828ef93e7eae03.exe"C:\Users\Admin\AppData\Local\Temp\188f6cc8554a4a5906828ef93e7eae03.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD5ec8d98427c19652763c32f9ed6e2c53b
SHA1e5cca4f1bfff38255b50b4b24eb5fcbfaa29eb3f
SHA25673e4498cfa7fa85a9315e0b4216fcc28ff754a2da01febfb5ca14110d9d70a34
SHA5121e679ae8437d2fb079680a9e71042260515f12042d565894512441e62c9a0bc72e15cba0382b5b562054693974ac288a035101dffc1afcc5d08022e6fdb4e5bd
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD5bdf2e244cdec7501c62257de113d49b6
SHA1ca884cbf8d6a0aeceda077641a1455382af42191
SHA2561c6f64158fe358f0dbc3e85c7db01dedc12e4ea37bf73d11c8f0c6d4d7d8e3c3
SHA512a1734d9e210bc6060c47f0372d824d647e936f892ad5413ab6cc3a0cb31ea5d8cac2ba23937ba118695ce1b677cd6df126bccc9a287910fd410aa194e7104e29