Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 11:18
Behavioral task
behavioral1
Sample
1a449ef21667543a276d8b0cd790a995.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
General
-
Target
1a449ef21667543a276d8b0cd790a995.exe
-
Size
298KB
-
MD5
1a449ef21667543a276d8b0cd790a995
-
SHA1
eac671e5a739c77e45544f5e2b39aaab4bb94fe1
-
SHA256
2ff5da388ecb4d0fcb4ca48cd18ec285096b4ee579098a15ab2e61a81a3bfe91
-
SHA512
3adf79c9a5cbdb0b608fe90911e356bddbbb7d030e5b4f55b11443294654cbdd521e02e6400c8f32b9c4264806a8a3869abf3c4add9e536c27cf103c1f451ec3
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYc:v6Wq4aaE6KwyF5L0Y2D1PqLr
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2176 svhost.exe -
resource yara_rule behavioral1/memory/2180-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x000b00000001225c-4.dat upx behavioral1/memory/2176-6-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x0007000000016d52-67.dat upx behavioral1/memory/2180-494-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-688-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-903-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-1831-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-2731-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-4052-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-4894-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-5685-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-5997-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-6880-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-7593-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-8651-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-9969-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-11027-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2176-12076-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2176-6-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2180-494-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-688-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-903-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-1831-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-2731-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-4052-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-4894-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-5685-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-5997-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-6880-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-7593-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-8651-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-9969-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-11027-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2176-12076-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 1a449ef21667543a276d8b0cd790a995.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2176 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2180 1a449ef21667543a276d8b0cd790a995.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2180 1a449ef21667543a276d8b0cd790a995.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2180 1a449ef21667543a276d8b0cd790a995.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe 2176 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2176 2180 1a449ef21667543a276d8b0cd790a995.exe 28 PID 2180 wrote to memory of 2176 2180 1a449ef21667543a276d8b0cd790a995.exe 28 PID 2180 wrote to memory of 2176 2180 1a449ef21667543a276d8b0cd790a995.exe 28 PID 2180 wrote to memory of 2176 2180 1a449ef21667543a276d8b0cd790a995.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a449ef21667543a276d8b0cd790a995.exe"C:\Users\Admin\AppData\Local\Temp\1a449ef21667543a276d8b0cd790a995.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD5264c80adc5847585df06f43215c16c69
SHA1100569e836f5b83a026f207a0fe6438222790281
SHA2562e3d6bb8e05e1ebdf44e3a1dc191e0c2698dae716f414c861074baca4a4d25ee
SHA5120d532aaed97199b28e5cad1b631b1bd01d64a7d7d4107c5cb2d67c72ea375aef4bab870eb6a47db6513d736532dff1b4a63f953ed1d886ec4eb4dff6f2713108
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD5fe2491b27f1583911fc8ab29e1c1d9f3
SHA1142d05ac9926b8dc9ddc9d2a119a99bace97e26e
SHA256e13931a2182031820ba73ea24e5427c8785bc9a4abce6aa73548777cb702c978
SHA5126eddadc7395cee8bcfdcddc42767a8eb519493829d950bbb7b97a4d063899f78f24e446fd6ebd5a729f3ab4e5a0f156d93b04e86d8103cae67e7653941e27cd5