Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 07:10
Behavioral task
behavioral1
Sample
5ba4428428af3443cf2850281cb42733.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5ba4428428af3443cf2850281cb42733.exe
Resource
win10v2004-20231222-en
General
-
Target
5ba4428428af3443cf2850281cb42733.exe
-
Size
310KB
-
MD5
5ba4428428af3443cf2850281cb42733
-
SHA1
2ccdd810a311f4dc5c5fef60d44396a6ff5088ee
-
SHA256
2a60eb4e064ef7da65c69790df433c8774e8f18ef29d12f148d01e0002d59a3f
-
SHA512
08d19e9550cf21ae33618bff62ad0fb23667f2394596d90572f2aadfc36489e607e39495da034a92a5118c55c4143e7a95533566dcebf0ece5057265ef9b2003
-
SSDEEP
6144:BYDau9n2z+Luag/AGPt/QpAGaeBY4NVYv6mlp18aCUYyVrTtLE:qWukz+Lu35Pt/GAGNNxmlX8aCcVrT5E
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2900-0-0x0000000000400000-0x00000000004BB000-memory.dmp upx behavioral1/memory/2900-15-0x0000000000400000-0x00000000004BB000-memory.dmp upx behavioral1/memory/2848-6-0x0000000000400000-0x00000000004BB000-memory.dmp upx behavioral1/memory/2848-16-0x0000000000400000-0x00000000004BB000-memory.dmp upx behavioral1/memory/2848-18-0x0000000000400000-0x00000000004BB000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Explorer = "C:\\Windows\\Explorer32DLL.exe" 5ba4428428af3443cf2850281cb42733.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\Explorer = "C:\\Windows\\Explorer32DLL.exe" 5ba4428428af3443cf2850281cb42733.exe -
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2900-15-0x0000000000400000-0x00000000004BB000-memory.dmp autoit_exe behavioral1/memory/2848-6-0x0000000000400000-0x00000000004BB000-memory.dmp autoit_exe behavioral1/memory/2848-16-0x0000000000400000-0x00000000004BB000-memory.dmp autoit_exe behavioral1/memory/2848-18-0x0000000000400000-0x00000000004BB000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Explorer32DLL.exe 5ba4428428af3443cf2850281cb42733.exe File opened for modification C:\Windows\Explorer32DLL.exe 5ba4428428af3443cf2850281cb42733.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2808 2676 WerFault.exe 19 -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2848 2900 5ba4428428af3443cf2850281cb42733.exe 18 PID 2900 wrote to memory of 2848 2900 5ba4428428af3443cf2850281cb42733.exe 18 PID 2900 wrote to memory of 2848 2900 5ba4428428af3443cf2850281cb42733.exe 18 PID 2900 wrote to memory of 2848 2900 5ba4428428af3443cf2850281cb42733.exe 18 PID 2900 wrote to memory of 2676 2900 5ba4428428af3443cf2850281cb42733.exe 19 PID 2900 wrote to memory of 2676 2900 5ba4428428af3443cf2850281cb42733.exe 19 PID 2900 wrote to memory of 2676 2900 5ba4428428af3443cf2850281cb42733.exe 19 PID 2900 wrote to memory of 2676 2900 5ba4428428af3443cf2850281cb42733.exe 19 PID 2900 wrote to memory of 2676 2900 5ba4428428af3443cf2850281cb42733.exe 19 PID 2900 wrote to memory of 2676 2900 5ba4428428af3443cf2850281cb42733.exe 19 PID 2900 wrote to memory of 2676 2900 5ba4428428af3443cf2850281cb42733.exe 19 PID 2676 wrote to memory of 2808 2676 5ba4428428af3443cf2850281cb42733.exe 21 PID 2676 wrote to memory of 2808 2676 5ba4428428af3443cf2850281cb42733.exe 21 PID 2676 wrote to memory of 2808 2676 5ba4428428af3443cf2850281cb42733.exe 21 PID 2676 wrote to memory of 2808 2676 5ba4428428af3443cf2850281cb42733.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ba4428428af3443cf2850281cb42733.exe"C:\Users\Admin\AppData\Local\Temp\5ba4428428af3443cf2850281cb42733.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\5ba4428428af3443cf2850281cb42733.exeC:\Users\Admin\AppData\Local\Temp\5ba4428428af3443cf2850281cb42733.exe /AutoIt3ExecuteLine "MsgBox('32', 'ROFL', 'DAS IST EIN LOOOOL :D Haha')"2⤵PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\5ba4428428af3443cf2850281cb42733.exe"C:\Users\Admin\AppData\Local\Temp\5ba4428428af3443cf2850281cb42733.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 363⤵
- Program crash
PID:2808
-
-