Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 12:51
Static task
static1
Behavioral task
behavioral1
Sample
1fdcdaf92f89e97e71b986df45b69618.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1fdcdaf92f89e97e71b986df45b69618.exe
Resource
win10v2004-20231215-en
General
-
Target
1fdcdaf92f89e97e71b986df45b69618.exe
-
Size
40KB
-
MD5
1fdcdaf92f89e97e71b986df45b69618
-
SHA1
4bc1d92e22f676df34cdd62d86e9332bc56d20f6
-
SHA256
ed170dd2a76723734f2218871155d6b6111f95ee27badb133539745e4341eb7b
-
SHA512
6dc4abdd66877fdb9d2a0abbdcea00ef805c6de6421818399d524c89ae4b0590ee64a81465f95f1ac8f0c683f1aadbee86eae2f601988d268fc5dd9f4b6c495f
-
SSDEEP
768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHMN:aqk/Zdic/qjh8w19JDHu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2716 services.exe -
resource yara_rule behavioral1/memory/2716-11-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/files/0x000b000000015d81-8.dat upx behavioral1/memory/2716-17-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2716-71-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" 1fdcdaf92f89e97e71b986df45b69618.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe 1fdcdaf92f89e97e71b986df45b69618.exe File opened for modification C:\Windows\java.exe 1fdcdaf92f89e97e71b986df45b69618.exe File created C:\Windows\java.exe 1fdcdaf92f89e97e71b986df45b69618.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2716 2372 1fdcdaf92f89e97e71b986df45b69618.exe 16 PID 2372 wrote to memory of 2716 2372 1fdcdaf92f89e97e71b986df45b69618.exe 16 PID 2372 wrote to memory of 2716 2372 1fdcdaf92f89e97e71b986df45b69618.exe 16 PID 2372 wrote to memory of 2716 2372 1fdcdaf92f89e97e71b986df45b69618.exe 16
Processes
-
C:\Windows\services.exe"C:\Windows\services.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2716
-
C:\Users\Admin\AppData\Local\Temp\1fdcdaf92f89e97e71b986df45b69618.exe"C:\Users\Admin\AppData\Local\Temp\1fdcdaf92f89e97e71b986df45b69618.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2