Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 12:32

General

  • Target

    1ea1904254b5424dcd3a07b0adf607f0.exe

  • Size

    283KB

  • MD5

    1ea1904254b5424dcd3a07b0adf607f0

  • SHA1

    35ea55804a79e772d00766edc02b375df74eeb8a

  • SHA256

    6ca52315ca17b81c46c0f2bd930deb8fc295a78e81a30f03bcaf3f330b3b8a22

  • SHA512

    46a60c8a8a42e63fa4ba32b4db7c8fa28342ad9dbdf78cf49ef74cdd8b968d0ba16e72597da6d9b67416d2b9bfeda3bce298856c83ebd5ec1776bf23f2f781f4

  • SSDEEP

    6144:tl5L7Q+1b+Nz65JvoanBCiIrRtEEztQZ/hmmeRg:P5L8akz6YjiIrbxtQZ/9eRg

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies data under HKEY_USERS 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ea1904254b5424dcd3a07b0adf607f0.exe
    "C:\Users\Admin\AppData\Local\Temp\1ea1904254b5424dcd3a07b0adf607f0.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\uninstal.bat
      2⤵
      • Deletes itself
      PID:2332
  • C:\Windows\ASP.exe
    C:\Windows\ASP.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
        PID:2764

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\ASP.exe

      Filesize

      283KB

      MD5

      1ea1904254b5424dcd3a07b0adf607f0

      SHA1

      35ea55804a79e772d00766edc02b375df74eeb8a

      SHA256

      6ca52315ca17b81c46c0f2bd930deb8fc295a78e81a30f03bcaf3f330b3b8a22

      SHA512

      46a60c8a8a42e63fa4ba32b4db7c8fa28342ad9dbdf78cf49ef74cdd8b968d0ba16e72597da6d9b67416d2b9bfeda3bce298856c83ebd5ec1776bf23f2f781f4

    • C:\Windows\uninstal.bat

      Filesize

      190B

      MD5

      54f6724a8e27f71d7bd5912cfe07f358

      SHA1

      e8fc77ee22f6f10bb8caa19fde8c80c347265afb

      SHA256

      4c914704de58621dc82762b69b77e7c77f964a1338e4d422181967e0292c613d

      SHA512

      66235e5b88cc239dc236a29a269a1551fee5875f519fbbaa63000613bf1876b765245f8978afde7f063232ebd00f2bce426f7d930dc9f5c999b6161062cb4183

    • memory/1736-0-0x0000000000400000-0x0000000000513000-memory.dmp

      Filesize

      1.1MB

    • memory/1736-1-0x0000000000240000-0x000000000024A000-memory.dmp

      Filesize

      40KB

    • memory/1736-2-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/1736-16-0x0000000000400000-0x0000000000513000-memory.dmp

      Filesize

      1.1MB

    • memory/2328-6-0x0000000000400000-0x0000000000513000-memory.dmp

      Filesize

      1.1MB

    • memory/2328-7-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/2328-18-0x0000000000400000-0x0000000000513000-memory.dmp

      Filesize

      1.1MB

    • memory/2328-19-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB