Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
29dbe08f63cb25b4d581d3e7a1cb451e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
29dbe08f63cb25b4d581d3e7a1cb451e.exe
Resource
win10v2004-20231215-en
General
-
Target
29dbe08f63cb25b4d581d3e7a1cb451e.exe
-
Size
1.1MB
-
MD5
29dbe08f63cb25b4d581d3e7a1cb451e
-
SHA1
4b63250dc5ec4a35e2fcb08b1fd9566fd558a824
-
SHA256
cdf5d42e939d76187f8fa92d0ba6bb1e8c2d49b24d2e6ea48eb8155b0d1eca40
-
SHA512
65a03e12c49f88cc7b8785d05c8f31fe7f8f069f76fa9c9e1ba0f30281105e1be6b919bd4b5327dd47d98bffed4c3695563c98860b953d4aeb535abba9e4b0fa
-
SSDEEP
24576:aTFrPShqyZ7gzuDBF5amKfRL9vo4CiD1kw7:IFrPS/Mq1FReRL9DL
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2168 29dbe08f63cb25b4d581d3e7a1cb451e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main 29dbe08f63cb25b4d581d3e7a1cb451e.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 29dbe08f63cb25b4d581d3e7a1cb451e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 29dbe08f63cb25b4d581d3e7a1cb451e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2168 29dbe08f63cb25b4d581d3e7a1cb451e.exe 2168 29dbe08f63cb25b4d581d3e7a1cb451e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2168 29dbe08f63cb25b4d581d3e7a1cb451e.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2168 29dbe08f63cb25b4d581d3e7a1cb451e.exe 2168 29dbe08f63cb25b4d581d3e7a1cb451e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29dbe08f63cb25b4d581d3e7a1cb451e.exe"C:\Users\Admin\AppData\Local\Temp\29dbe08f63cb25b4d581d3e7a1cb451e.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156B
MD51ea9e5b417811379e874ad4870d5c51a
SHA1a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
-
Filesize
5KB
MD5fb45d7f6fb4d518a0ecc05cf7ce5363c
SHA1df12738b2ac098ce57c3173535feec07c5a9b3bf
SHA2564a01a4d6e711e873a065510a407cb6d37535d8becabbcfe9f05fe3dec13e5b9e
SHA5128cf60b35028266d459173db28d780a55acc8830ce8f86c2662be9864424134f647f10abb38e2aaaee24871c964eaea6abbb0eae256639d97c1e76ceddb7c3424
-
Filesize
506B
MD55335f1c12201b5f7cf5f8b4f5692e3d1
SHA113807a10369f7ff9ab3f9aba18135bccb98bec2d
SHA256974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
SHA5120d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df
-
Filesize
808B
MD5ccfbcbb51598a1946b19ff56c4ae9bd1
SHA183c5a77c766253d2c22e3b893408fe60acb46113
SHA2567ec494b43d8c70c338929fd88af752e117bb924a4284b93567e7b8c9cb79be9f
SHA5124a7b08a008350460beeb60e9473e497ab1c67d5ef60e927bb35a8cae574fd177b2c1a8e2df26d655e28b4ec4726d5616938ed4a612cbfcfa8f52f82d0de94426
-
Filesize
698B
MD5124bc01ea52af57ca245837d87460f4b
SHA1d2726285b847e7d43c937f304b16b2cbce059662
SHA256f12fd05169348634a4fead731020fea3b9db80a1b1738b5db8488b45ef480475
SHA512e2f9006f8a0126ef9927a502dc1088a60af1fd36bd64deb5193e5abe2beaaeeb3c0bc47135070d7aa949205df592221e7b0bc62c3b5c420b59778b0dafa498ee
-
Filesize
493B
MD5818b8908ace0ccc5fecbca20f2919587
SHA1e599b4229d622c36bc6cd5b155c94c50d1a68b86
SHA256ad2ec992fc336af09f7be4a652d240936a08bf522d10ff7fbec5dbfe0c4d332d
SHA5127d63287a12f519524146f7ed620aee6724489fa351752e7eb64e99fae098e524e744e570d2b7abc21f89064cff2bdaa9864f7f0cda9fb9ca861d1df9a45bcd9f
-
Filesize
104B
MD535a600a752d3074501de31a516860499
SHA151eac62cf77a0b88a3e9cb9ee6f85def21fd4bcf
SHA25614e064857751b23da7bbe40861ef4caf99b2496227507b8e3108fbac6d901f75
SHA512046ec179571d239bfb2d51be9837f96d9afebf2e5db77bba0f4a25ce8716d37581a3f9753bd2dbb04c47711699a9d93987bceb71df0b8becf8c577d660320069
-
Filesize
812B
MD5eabb61abba55f80af418fa1128d1548d
SHA1a5ee1d55de2cc60966039120c830fc19cefb0351
SHA256717f3f02f5d5fd1478b6d2ec44acef6e70bb8f1adcf2dc030c08b92e851737e1
SHA512d232072c9540bf0e2fd56f353c2cc83518eabf8282cc02d9f8bec81c0341287ada29ba79f2a515d68722658686b6cce97be138a48f44409562d9a567af200bd6
-
Filesize
221B
MD507cd59b954e8495ad6cd6a7c11d2de86
SHA1787aeda3eee8053705fb208a6b399b8340820b82
SHA2566e6b964fd79b4a3461f128e2ed145b9b641d108b8616695f36387661cae995bb
SHA5120159aca0c2a49393fd91acd4b6819217e67f8fd01e220297eb3e0fdd8132fad794fc317f5cc5e2b761d4123da71478b97df776908de6740eb6d54187c6c00754
-
Filesize
681B
MD55f8dcbf4ebc42ad95cfc4d9401283972
SHA1e4060ea37daa2953bfdf8a773e447143f6365e75
SHA256931193720d26f0007ad223fca1a440f4866047a0ca96f5d29de3e62e7ba6a731
SHA512f918c4b834dff01c82f4b0063708d9155aef87b40fa3ae101d5d0a761ed17a348ff6ba4fb5f1e6ba4921698dcbb3e8291a25e48d180092107cb05660d948a61d
-
Filesize
15KB
MD5a82385e6e784a58498776f9001e536c5
SHA1a621597c1cb808e1dbeb767b82435983a58a38f6
SHA256d0fa6ec1933c54c4993f15bdf4293dbf918d7b2f213451f7e8d093d7314a2c95
SHA512da54185edc9c1ad91e2c2d8943ce9f06d6c549495fefa945c60b353bff1a6577d464370bc91b5ad840cd65733b429924978d9373f3c19f9a0d4908d9fa96b1f8
-
Filesize
207B
MD5c222a4f3d309721c0898606960120266
SHA1cdee967961a3ea87565ae7ca287be8ed20496160
SHA256f638cc042b7ade6f43f2faf0077e020137562e559178396b7e975db39ac13df6
SHA512db52224964ffd03fa65fddabea29d4f7c23840a18d1ad1028f228589c8c642280a762d2f4250159106f911455b8f0706a3b204dcbbb0484638d4f41f4f54a836
-
Filesize
10KB
MD557ca1a2085d82f0574e3ef740b9a5ead
SHA12974f4bf37231205a256f2648189a461e74869c0
SHA256476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
SHA5122d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c
-
Filesize
1KB
MD53a6bdc78f84edb8c6980a4bc6020c4e0
SHA1c2fec93ac1fed48009f9e201ee09b787cec62ef5
SHA25688fbcb9faa6fd0bbb7e78687415e7c669677b9b7fc89e66a829ddbc967698d3c
SHA512cdb62830a81f729aefcb6f6e615b20e6007bb37dd946d1bf71a4dfdfce47f2431d4a89bddab0aaddaedda11281830e3ae9d771beb9e70e18c70e35a22297bf97
-
Filesize
1.1MB
MD529dbe08f63cb25b4d581d3e7a1cb451e
SHA14b63250dc5ec4a35e2fcb08b1fd9566fd558a824
SHA256cdf5d42e939d76187f8fa92d0ba6bb1e8c2d49b24d2e6ea48eb8155b0d1eca40
SHA51265a03e12c49f88cc7b8785d05c8f31fe7f8f069f76fa9c9e1ba0f30281105e1be6b919bd4b5327dd47d98bffed4c3695563c98860b953d4aeb535abba9e4b0fa