Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 12:32
Static task
static1
Behavioral task
behavioral1
Sample
1ea1904254b5424dcd3a07b0adf607f0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1ea1904254b5424dcd3a07b0adf607f0.exe
Resource
win10v2004-20231222-en
General
-
Target
1ea1904254b5424dcd3a07b0adf607f0.exe
-
Size
283KB
-
MD5
1ea1904254b5424dcd3a07b0adf607f0
-
SHA1
35ea55804a79e772d00766edc02b375df74eeb8a
-
SHA256
6ca52315ca17b81c46c0f2bd930deb8fc295a78e81a30f03bcaf3f330b3b8a22
-
SHA512
46a60c8a8a42e63fa4ba32b4db7c8fa28342ad9dbdf78cf49ef74cdd8b968d0ba16e72597da6d9b67416d2b9bfeda3bce298856c83ebd5ec1776bf23f2f781f4
-
SSDEEP
6144:tl5L7Q+1b+Nz65JvoanBCiIrRtEEztQZ/hmmeRg:P5L8akz6YjiIrbxtQZ/9eRg
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2332 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2328 ASP.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ASP.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ASP.exe 1ea1904254b5424dcd3a07b0adf607f0.exe File created C:\Windows\uninstal.bat 1ea1904254b5424dcd3a07b0adf607f0.exe File created C:\Windows\ASP.exe 1ea1904254b5424dcd3a07b0adf607f0.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings ASP.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ASP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ASP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" ASP.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ASP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE}\WpadDecisionReason = "1" ASP.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE}\WpadDecisionTime = 902b2eed5e39da01 ASP.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ASP.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE}\WpadNetworkName = "Network 3" ASP.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ASP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE}\WpadDecision = "0" ASP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE} ASP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-35-74-fb-c4-dc\WpadDecision = "0" ASP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" ASP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" ASP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE}\2e-35-74-fb-c4-dc ASP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad ASP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ASP.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ASP.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-35-74-fb-c4-dc ASP.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-35-74-fb-c4-dc\WpadDecisionReason = "1" ASP.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-35-74-fb-c4-dc\WpadDecisionTime = 902b2eed5e39da01 ASP.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ASP.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ASP.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1736 1ea1904254b5424dcd3a07b0adf607f0.exe Token: SeDebugPrivilege 2328 ASP.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2328 ASP.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2764 2328 ASP.exe 29 PID 2328 wrote to memory of 2764 2328 ASP.exe 29 PID 2328 wrote to memory of 2764 2328 ASP.exe 29 PID 2328 wrote to memory of 2764 2328 ASP.exe 29 PID 1736 wrote to memory of 2332 1736 1ea1904254b5424dcd3a07b0adf607f0.exe 30 PID 1736 wrote to memory of 2332 1736 1ea1904254b5424dcd3a07b0adf607f0.exe 30 PID 1736 wrote to memory of 2332 1736 1ea1904254b5424dcd3a07b0adf607f0.exe 30 PID 1736 wrote to memory of 2332 1736 1ea1904254b5424dcd3a07b0adf607f0.exe 30 PID 1736 wrote to memory of 2332 1736 1ea1904254b5424dcd3a07b0adf607f0.exe 30 PID 1736 wrote to memory of 2332 1736 1ea1904254b5424dcd3a07b0adf607f0.exe 30 PID 1736 wrote to memory of 2332 1736 1ea1904254b5424dcd3a07b0adf607f0.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ea1904254b5424dcd3a07b0adf607f0.exe"C:\Users\Admin\AppData\Local\Temp\1ea1904254b5424dcd3a07b0adf607f0.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\uninstal.bat2⤵
- Deletes itself
PID:2332
-
-
C:\Windows\ASP.exeC:\Windows\ASP.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵PID:2764
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283KB
MD51ea1904254b5424dcd3a07b0adf607f0
SHA135ea55804a79e772d00766edc02b375df74eeb8a
SHA2566ca52315ca17b81c46c0f2bd930deb8fc295a78e81a30f03bcaf3f330b3b8a22
SHA51246a60c8a8a42e63fa4ba32b4db7c8fa28342ad9dbdf78cf49ef74cdd8b968d0ba16e72597da6d9b67416d2b9bfeda3bce298856c83ebd5ec1776bf23f2f781f4
-
Filesize
190B
MD554f6724a8e27f71d7bd5912cfe07f358
SHA1e8fc77ee22f6f10bb8caa19fde8c80c347265afb
SHA2564c914704de58621dc82762b69b77e7c77f964a1338e4d422181967e0292c613d
SHA51266235e5b88cc239dc236a29a269a1551fee5875f519fbbaa63000613bf1876b765245f8978afde7f063232ebd00f2bce426f7d930dc9f5c999b6161062cb4183