Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 13:56
Static task
static1
Behavioral task
behavioral1
Sample
237e5bed4efbb1756da7382da0d313f7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
237e5bed4efbb1756da7382da0d313f7.exe
Resource
win10v2004-20231215-en
General
-
Target
237e5bed4efbb1756da7382da0d313f7.exe
-
Size
67KB
-
MD5
237e5bed4efbb1756da7382da0d313f7
-
SHA1
07e3d470fccdd49e1f53c4a8f6ca8faa0eead2ff
-
SHA256
e72e91ed48ffd1e533e2bc7c1b2114d7b61e7fc6e0fdb037207324263d128e85
-
SHA512
d03fa5bfef25d6e9d245e5b0b4bfe1b883de6ffc7544a3c08e0323a68efe6f73c4a43844750c0bc67d7992dc4a1b58b926436fb33a3501dd03678edf0068bb6a
-
SSDEEP
1536:e647AIp0kjpFuQQbL4EVU0mVRNEwDBwx0/7Mi/HOmoUwEz:rcAIPjpnYLNugwDGx0/B/dR
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\qivdnm\Parameters\ServiceDll = "%SystemRoot%\\System32\\mewdpt.dll" 237e5bed4efbb1756da7382da0d313f7.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\qivdnm\Parameters\ServiceDll = "%SystemRoot%\\System32\\mewdpt.dll" 237e5bed4efbb1756da7382da0d313f7.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\qivdnm\Parameters\ServiceDll = "%SystemRoot%\\System32\\mewdpt.dll" 237e5bed4efbb1756da7382da0d313f7.exe -
Deletes itself 1 IoCs
pid Process 2828 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 1792 237e5bed4efbb1756da7382da0d313f7.exe 2828 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\0004167b.sys 237e5bed4efbb1756da7382da0d313f7.exe File created C:\Windows\SysWOW64\mewdpt.dll 237e5bed4efbb1756da7382da0d313f7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\237e5bed4efbb1756da7382da0d313f7.exe"C:\Users\Admin\AppData\Local\Temp\237e5bed4efbb1756da7382da0d313f7.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:1792
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k qivdnm1⤵
- Deletes itself
- Loads dropped DLL
PID:2828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD55569bc7cc576030d4e95fc9683040ec8
SHA191e35afbec035a854f7e5dcc380bf7f25a172247
SHA256dd4bded4a85fc4142093963b837aa7e419cc246046a9b0990506a3d5534c60f2
SHA512a41666adcd50132d5797b6ac43bdf67608fa37c5c87dbd3193d68cec4a7827366cd86b087f6b4ade1d8a265535c3ad7d8b730c157935dbc51aaa991fb86022ff