Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 19:10
Static task
static1
Behavioral task
behavioral1
Sample
0153c459dfa933ede22885a57b467cb1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0153c459dfa933ede22885a57b467cb1.exe
Resource
win10v2004-20231222-en
General
-
Target
0153c459dfa933ede22885a57b467cb1.exe
-
Size
188KB
-
MD5
0153c459dfa933ede22885a57b467cb1
-
SHA1
50a1ecaa12fbdeb4ffc7bc37f6b97286f95dee51
-
SHA256
e48d30d2c781d18c59cb543008c2b1ada45894e4985868e9ba2e2c6e13177a2e
-
SHA512
f348ea08916715dbaa4a58f37030f4bc76e96b25a2c59b75427aba57ecd9ffc6b06e9098573e20709fdecc9589b46134e3e39d63e7e28afccb678adae5ffeb4f
-
SSDEEP
3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8dh1j:o68i3odBiTl2+TCU/s1j
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft I Service = "C:\\Windows\\winhash_up.exe /REGstart" 0153c459dfa933ede22885a57b467cb1.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\winhash_up.exez 0153c459dfa933ede22885a57b467cb1.exe File opened for modification C:\Windows\winhash_up.exez 0153c459dfa933ede22885a57b467cb1.exe File created C:\Windows\SHARE_TEMP\Icon7.ico 0153c459dfa933ede22885a57b467cb1.exe File created C:\Windows\SHARE_TEMP\Icon10.ico 0153c459dfa933ede22885a57b467cb1.exe File created C:\Windows\SHARE_TEMP\Icon13.ico 0153c459dfa933ede22885a57b467cb1.exe File created C:\Windows\SHARE_TEMP\Icon3.ico 0153c459dfa933ede22885a57b467cb1.exe File created C:\Windows\SHARE_TEMP\Icon6.ico 0153c459dfa933ede22885a57b467cb1.exe File created C:\Windows\winhash_up.exe 0153c459dfa933ede22885a57b467cb1.exe File created C:\Windows\SHARE_TEMP\Icon14.ico 0153c459dfa933ede22885a57b467cb1.exe File created C:\Windows\SHARE_TEMP\Icon2.ico 0153c459dfa933ede22885a57b467cb1.exe File created C:\Windows\SHARE_TEMP\Icon5.ico 0153c459dfa933ede22885a57b467cb1.exe File created C:\Windows\SHARE_TEMP\Icon12.ico 0153c459dfa933ede22885a57b467cb1.exe File created C:\Windows\bugMAKER.bat 0153c459dfa933ede22885a57b467cb1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2980 2900 0153c459dfa933ede22885a57b467cb1.exe 27 PID 2900 wrote to memory of 2980 2900 0153c459dfa933ede22885a57b467cb1.exe 27 PID 2900 wrote to memory of 2980 2900 0153c459dfa933ede22885a57b467cb1.exe 27 PID 2900 wrote to memory of 2980 2900 0153c459dfa933ede22885a57b467cb1.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\0153c459dfa933ede22885a57b467cb1.exe"C:\Users\Admin\AppData\Local\Temp\0153c459dfa933ede22885a57b467cb1.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\bugMAKER.bat2⤵PID:2980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76B
MD5a51c205a20333e1fae90bb3e11d31126
SHA1e9023e392cd0a727dc78504663e425f1c4a1d932
SHA256417ff18e7ab2ac09be38a589253ad15e1705271e18af82323f267567cbc97d7c
SHA51233967c86435b3db10bd598d9fa6ad81dea4f33ac6fa9fa20fbb9ab3f8e00d280a61188ea222370e60c7aa12742f5f37878d9361aeb8851eda4f594264c682147