Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2023, 19:12

General

  • Target

    015fe015cf765310d7f52d7d26bd7c87.exe

  • Size

    136KB

  • MD5

    015fe015cf765310d7f52d7d26bd7c87

  • SHA1

    0d1578c7c9d7eeeda0c06f557c2e09cb1478ae0c

  • SHA256

    b8cd4f5f312fe974ebc19987368682ce4da056a4721be1c7fc30844eda124e8e

  • SHA512

    18b45771ead496cadd2618df96465157b1bbc0b81d044392f3bb5b9fdcb921fbc66f7a5bbfdd32db583d20cfb6da9dbc0c97b0de2b41e2f1742b76f3848fdff8

  • SSDEEP

    3072:BmQUgwjBfQn7WbIqH0ybZBiOllyEmcP82+aVdOt66VGegmN:Bm1Qn7WbIqH0ybZBiOllyE5D+aVkjseN

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\015fe015cf765310d7f52d7d26bd7c87.exe
    "C:\Users\Admin\AppData\Local\Temp\015fe015cf765310d7f52d7d26bd7c87.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Users\Admin\siobiu.exe
      "C:\Users\Admin\siobiu.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\siobiu.exe

    Filesize

    136KB

    MD5

    382c5f1fba6b336882fc2aaf8cdb5993

    SHA1

    d70b7589d12270bc953deb0a218310f61bc33254

    SHA256

    a105a38633f4cb6bb206ff38cbfbc374d00a1c07aa7759ff250fe6c86a49d4a7

    SHA512

    5e43e0b340c4d6a7e31565cb376920fb693d40c188c02493e84657a8d6feae3dadd3e38556ff27ce351049c1edb94c9ac9f57040dace2e4f1a81c19d71e4bf41