Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 13:12
Behavioral task
behavioral1
Sample
20d521c4f349238b69f89b22782aa451.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
20d521c4f349238b69f89b22782aa451.exe
Resource
win10v2004-20231215-en
General
-
Target
20d521c4f349238b69f89b22782aa451.exe
-
Size
33KB
-
MD5
20d521c4f349238b69f89b22782aa451
-
SHA1
c2fd4c7cf07e55e3fde5489e53c67c56ece06bd0
-
SHA256
8dc945fb22004202a2135696f071a9f242cc4d1185a6e5652de46d3e00ddb824
-
SHA512
35a4a0b0d02bcee4caf28cd85595bbea4c8dfe21c831ebfc34b3db2bd8fcc3b37cb3e6561829b1ddc8267eeb42ea5971cb279aa24f833bd66c3d8cf087c4ab75
-
SSDEEP
768:Vcx9urLky4oRaJmnjaad4ATyfBXGvUYGMr2FNbuSK1TLNQKhUJb+M:VnrI6aJYjaa+ATypWsPpud1Hhg+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1288 taskmngr32.exe -
Loads dropped DLL 2 IoCs
pid Process 2532 20d521c4f349238b69f89b22782aa451.exe 2532 20d521c4f349238b69f89b22782aa451.exe -
resource yara_rule behavioral1/memory/1288-12-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/files/0x000c00000001224c-11.dat upx behavioral1/memory/2532-4-0x0000000002AA0000-0x0000000002AD3000-memory.dmp upx behavioral1/memory/2532-1-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/1288-13-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral1/memory/1288-14-0x0000000000400000-0x0000000000433000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Task Manager Win32 = "C:\\Windows\\SysWOW64\\taskmngr32.exe" taskmngr32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\taskmngr32.exe 20d521c4f349238b69f89b22782aa451.exe File opened for modification C:\Windows\SysWOW64\taskmngr32.exe 20d521c4f349238b69f89b22782aa451.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1288 2532 20d521c4f349238b69f89b22782aa451.exe 14 PID 2532 wrote to memory of 1288 2532 20d521c4f349238b69f89b22782aa451.exe 14 PID 2532 wrote to memory of 1288 2532 20d521c4f349238b69f89b22782aa451.exe 14 PID 2532 wrote to memory of 1288 2532 20d521c4f349238b69f89b22782aa451.exe 14
Processes
-
C:\Windows\SysWOW64\taskmngr32.exe"C:\Windows\system32\taskmngr32.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1288
-
C:\Users\Admin\AppData\Local\Temp\20d521c4f349238b69f89b22782aa451.exe"C:\Users\Admin\AppData\Local\Temp\20d521c4f349238b69f89b22782aa451.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD520d521c4f349238b69f89b22782aa451
SHA1c2fd4c7cf07e55e3fde5489e53c67c56ece06bd0
SHA2568dc945fb22004202a2135696f071a9f242cc4d1185a6e5652de46d3e00ddb824
SHA51235a4a0b0d02bcee4caf28cd85595bbea4c8dfe21c831ebfc34b3db2bd8fcc3b37cb3e6561829b1ddc8267eeb42ea5971cb279aa24f833bd66c3d8cf087c4ab75