Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
1bc2d486735244a0b77768ba6c0d320c.exe
Resource
win7-20231215-en
General
-
Target
1bc2d486735244a0b77768ba6c0d320c.exe
-
Size
1.2MB
-
MD5
1bc2d486735244a0b77768ba6c0d320c
-
SHA1
2d5690f5572384cc343ea7bcc6e67aac585f1f8b
-
SHA256
beace8df01346080162d047f3fd3ead1e2b87d7bdaf03525000d51386285cb7a
-
SHA512
c9e583b71a9dac8929b61914e5a03f640c7353166591b896e984a26de0802923bb49009967e1497a35f18a20169a0c295815a8e9da15a2d9ced5e913afd9e700
-
SSDEEP
24576:Ltb20pkaCqT5TBWgNQ7aIw9j5A4O9Hwuqj61ZZlRDMsNV6A6:IVg5tQ7aIw9ju4OW56XzSsr56
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tpgknwazxqhbcpq.fr.url 1bc2d486735244a0b77768ba6c0d320c.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2312 set thread context of 2380 2312 1bc2d486735244a0b77768ba6c0d320c.exe 29 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2312 1bc2d486735244a0b77768ba6c0d320c.exe 2312 1bc2d486735244a0b77768ba6c0d320c.exe 2312 1bc2d486735244a0b77768ba6c0d320c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2380 RegAsm.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2312 1bc2d486735244a0b77768ba6c0d320c.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2380 RegAsm.exe Token: 33 2380 RegAsm.exe Token: SeIncBasePriorityPrivilege 2380 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2380 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2380 2312 1bc2d486735244a0b77768ba6c0d320c.exe 29 PID 2312 wrote to memory of 2380 2312 1bc2d486735244a0b77768ba6c0d320c.exe 29 PID 2312 wrote to memory of 2380 2312 1bc2d486735244a0b77768ba6c0d320c.exe 29 PID 2312 wrote to memory of 2380 2312 1bc2d486735244a0b77768ba6c0d320c.exe 29 PID 2312 wrote to memory of 2380 2312 1bc2d486735244a0b77768ba6c0d320c.exe 29 PID 2312 wrote to memory of 2380 2312 1bc2d486735244a0b77768ba6c0d320c.exe 29 PID 2312 wrote to memory of 2380 2312 1bc2d486735244a0b77768ba6c0d320c.exe 29 PID 2312 wrote to memory of 2380 2312 1bc2d486735244a0b77768ba6c0d320c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bc2d486735244a0b77768ba6c0d320c.exe"C:\Users\Admin\AppData\Local\Temp\1bc2d486735244a0b77768ba6c0d320c.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\1bc2d486735244a0b77768ba6c0d320c.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2380
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2924
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
322KB
MD5f7bbceb6799a7c8d1ff9d81a3675ad32
SHA13bf6ce17f1a4f61539f9a20626a9b897e69e234a
SHA256ea355cd5de5b92fc8ad7900cf258c00c2ce7e6a9123cb33386f733c885edc358
SHA5122de1a4db0e20d0eec283cdf475ad1032b6453ccb2d44248ef4f50638f13ae44f368a58a18d937136b9f2bebb61084136f43afdd4afe59b62f567842fcccc9142