Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
1a4a36a0e7f4036c781b2c792322ab16.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1a4a36a0e7f4036c781b2c792322ab16.exe
Resource
win10v2004-20231215-en
General
-
Target
1a4a36a0e7f4036c781b2c792322ab16.exe
-
Size
602KB
-
MD5
1a4a36a0e7f4036c781b2c792322ab16
-
SHA1
bd9902567a6179433cbcee08ff555011ec90ec03
-
SHA256
49b3e108316cc7864d517d86061d6e7b3b53bd2652c08528f70908607f0975a7
-
SHA512
dd9bed4181107e213e1947375e7b47e22afd5a278edd4b65fb375fed598861b730ce7e9e13a8ec7b3e9fb7f0ec9b0ba5090ccd562a4737bb1e15ee3f9a8957ac
-
SSDEEP
12288:amk1GlMbi6smHy/wM6jXTQDC0sZDtt+lmEZc9dkqCVVqvNH/NDxCql:af1rbiwywBXTPZGlw9dhCyxNDg
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2380-0-0x0000000001D20000-0x0000000001E48000-memory.dmp upx behavioral1/memory/2380-2-0x0000000001D20000-0x0000000001E48000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~2\is259395592.log 1a4a36a0e7f4036c781b2c792322ab16.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main 1a4a36a0e7f4036c781b2c792322ab16.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2380 1a4a36a0e7f4036c781b2c792322ab16.exe 2380 1a4a36a0e7f4036c781b2c792322ab16.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2380 1a4a36a0e7f4036c781b2c792322ab16.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2380 1a4a36a0e7f4036c781b2c792322ab16.exe 2380 1a4a36a0e7f4036c781b2c792322ab16.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a4a36a0e7f4036c781b2c792322ab16.exe"C:\Users\Admin\AppData\Local\Temp\1a4a36a0e7f4036c781b2c792322ab16.exe"1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2380