Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 11:23
Behavioral task
behavioral1
Sample
4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
Resource
win10v2004-20231222-en
General
-
Target
4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe
-
Size
536KB
-
MD5
50ca59b1337fd05ac7e4801d1f0615b4
-
SHA1
12a223fdf7fdbcfde6043c29b61df08c2381b607
-
SHA256
4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9
-
SHA512
3c3b9c28b8335ad4b25174c42bd83f0fc35de76da992f679f1364be72d7199eb34ce4368227399835c488674850dfde51ebb27ff53350d9259c9715039aa354f
-
SSDEEP
12288:rhf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:rdQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1692-0-0x0000000000F50000-0x0000000001052000-memory.dmp upx behavioral1/memory/1692-44-0x0000000000F50000-0x0000000001052000-memory.dmp upx behavioral1/memory/1692-420-0x0000000000F50000-0x0000000001052000-memory.dmp upx behavioral1/memory/1692-479-0x0000000000F50000-0x0000000001052000-memory.dmp upx behavioral1/memory/1692-576-0x0000000000F50000-0x0000000001052000-memory.dmp upx behavioral1/memory/1692-616-0x0000000000F50000-0x0000000001052000-memory.dmp upx -
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.114.114 Destination IP 223.5.5.5 Destination IP 223.5.5.5 Destination IP 114.114.114.114 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\1cf7b8 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1692 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe 1692 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe 1692 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe 1692 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe 1692 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1692 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe Token: SeTcbPrivilege 1692 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe Token: SeDebugPrivilege 1692 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe Token: SeDebugPrivilege 1356 Explorer.EXE Token: SeTcbPrivilege 1356 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1356 1692 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe 7 PID 1692 wrote to memory of 1356 1692 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe 7 PID 1692 wrote to memory of 1356 1692 4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe 7
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe"C:\Users\Admin\AppData\Local\Temp\4d094492b63588e1654d6a09d2a45dd6ed8173cfda8430f5ae075902863e9df9.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1356
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5a241438ce73f4e295e4d8fac33ddf4
SHA1649062b4531fc93940a30342fab605a8010fc7b5
SHA2565954d0c3c3d483aef7af4ad85448f40b77f8cd96ea1de48d8482f89face6d70b
SHA512be39c642c0067864cb81100f0bf6285931e1dc4a1e4768d1d10c60dc88e4495816fcf01b1a5e4a2bbc653bb49259c94ca809f0b8da59fb9527e10295541767cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4456797abcc1e0c32b4aeb7d50ecd43
SHA1b2d625bd4a02222335b9d9c1225f8baf9cdf5484
SHA256ebefc59d810bbde5311fd72d64681a0aa4c47d936cf300f5d8869bfcf9470deb
SHA512cf86d3e7c9c36424c7bde382adc845bb51393eacab3280e0d5be6e58e69e43badf7b46638207b5b6b0c6d90eecd3c99e50bfaac5a0d72c10d785e42a30a4c336
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5104c3a0b13fc19e63c18c3ec6624388f
SHA1d94110e784b7b31d0ca0214ab0f70e2f59ac33e5
SHA256fbab24385dee49daf0b2dc14838ed155c30fd6ccc4f63f2d41dc4de7b2bbf5c0
SHA512b55d86f530b09e8339bdc505d32f165050b04b487a103bc9b79213de93ba882499a8a8ad065f402254ee0f71a3230e8c02839844dc58702c6a60dca07fc50785
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06