Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 10:51
Behavioral task
behavioral1
Sample
188f6cc8554a4a5906828ef93e7eae03.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
General
-
Target
188f6cc8554a4a5906828ef93e7eae03.exe
-
Size
298KB
-
MD5
188f6cc8554a4a5906828ef93e7eae03
-
SHA1
c634a657a244819b91b69e5343d0005a4d70aa06
-
SHA256
54bc451f7c277e47b7b91817f671d86ac0dab1677cb4897643cad2ab99e44372
-
SHA512
2abcc1fd656f9933e79556aec02bc060d556fe729d995ffa5a6548c341ea4e82e780a59b4276e1a722aefbd97ff12a8c03ba0e6668a7d0e43cb4502d17fe5f09
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYP:v6Wq4aaE6KwyF5L0Y2D1PqLQ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 4160 svhost.exe -
resource yara_rule behavioral2/memory/3712-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x00070000000231ff-3.dat upx behavioral2/memory/3712-56-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-61-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3712-67-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x0009000000023200-106.dat upx behavioral2/memory/4160-266-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-438-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-488-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-843-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-1871-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-2897-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-4067-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-5090-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-6022-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-7059-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-7276-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-7678-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-8537-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4160-9558-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\v: svhost.exe -
AutoIT Executable 17 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3712-56-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-61-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3712-67-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-266-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-438-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-488-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-843-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-1871-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-2897-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-4067-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-5090-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-6022-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-7059-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-7276-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-7678-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-8537-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4160-9558-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Driver.db svhost.exe File created C:\Windows\svhost.exe 188f6cc8554a4a5906828ef93e7eae03.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3712 188f6cc8554a4a5906828ef93e7eae03.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4160 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3712 188f6cc8554a4a5906828ef93e7eae03.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 4160 svhost.exe 4160 svhost.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 4160 svhost.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3712 188f6cc8554a4a5906828ef93e7eae03.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 4160 svhost.exe 4160 svhost.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 4160 svhost.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 3712 188f6cc8554a4a5906828ef93e7eae03.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe 4160 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3712 wrote to memory of 4160 3712 188f6cc8554a4a5906828ef93e7eae03.exe 91 PID 3712 wrote to memory of 4160 3712 188f6cc8554a4a5906828ef93e7eae03.exe 91 PID 3712 wrote to memory of 4160 3712 188f6cc8554a4a5906828ef93e7eae03.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\188f6cc8554a4a5906828ef93e7eae03.exe"C:\Users\Admin\AppData\Local\Temp\188f6cc8554a4a5906828ef93e7eae03.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD5369872a0eca2d8d209315014566c8906
SHA130a99881c8ba551f829fb4478ead8abe40162838
SHA25672ed74982718814f4c3cc779cedde06096984bedaf6f2ffb243ca3495cc0aac7
SHA512ade7add8e312ef34d5cb088931d384eb80706a8d243cb0885a259f1e7a8904c3a954740cb2586dee77eb3456151a204d0830718be1127e89ff0417070003b11b
-
Filesize
298KB
MD587237c2d8feeb549bbcebfcc2180b381
SHA19fdddca58803eca2cffac2954e3e48f4fcddd985
SHA25688a9479fd6842b8709c823ef80aa7c63dadb71657806619eb31d6f4bb260febb
SHA512e8bfef06bd4066b544ac4f5ca0e8af4bfa3c348590969ea397d39167c366eb3a30a35ebe1749cf078a85c09a92d7d11f2baa9d31e350240bf10d2169230a8e8f