Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 22:06
Behavioral task
behavioral1
Sample
1df6b8284f2ee66d546efa938f571765.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1df6b8284f2ee66d546efa938f571765.exe
Resource
win10v2004-20231215-en
General
-
Target
1df6b8284f2ee66d546efa938f571765.exe
-
Size
1.1MB
-
MD5
1df6b8284f2ee66d546efa938f571765
-
SHA1
f56428c36db6657f2b90fe691d19439cb7159013
-
SHA256
2001fa457ae8c2ec82ee261e185b842b622bae3ead54e68434899a182190ddbe
-
SHA512
d6f38989469551d4f2032538043aba9a30e76d03b86d594cdc7d8736f150b2c593117aff9388d807628d7afbfdbc5edb5831dd03696d72ed724d986145c5f8c4
-
SSDEEP
24576:1NHlDWGouKPL+mk2ksI/rq38Xn27Y+A4eoEdbMP6KmZmY0x3ZWUhPokTM:1/XoVL+J2j9MXyY+ibNC643n9o3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1988 setup.exe -
Loads dropped DLL 1 IoCs
pid Process 3000 1df6b8284f2ee66d546efa938f571765.exe -
resource yara_rule behavioral1/memory/3000-0-0x0000000000F80000-0x00000000011D4000-memory.dmp upx behavioral1/files/0x000c0000000122f9-2.dat upx behavioral1/memory/3000-4-0x00000000028B0000-0x0000000002B04000-memory.dmp upx behavioral1/memory/3000-7-0x0000000000F80000-0x00000000011D4000-memory.dmp upx behavioral1/memory/1988-9-0x0000000000F30000-0x0000000001184000-memory.dmp upx behavioral1/memory/1988-29-0x0000000000F30000-0x0000000001184000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main setup.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" setup.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1988 setup.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1988 setup.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 3000 1df6b8284f2ee66d546efa938f571765.exe 3000 1df6b8284f2ee66d546efa938f571765.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe 1988 setup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3000 wrote to memory of 1988 3000 1df6b8284f2ee66d546efa938f571765.exe 28 PID 3000 wrote to memory of 1988 3000 1df6b8284f2ee66d546efa938f571765.exe 28 PID 3000 wrote to memory of 1988 3000 1df6b8284f2ee66d546efa938f571765.exe 28 PID 3000 wrote to memory of 1988 3000 1df6b8284f2ee66d546efa938f571765.exe 28 PID 3000 wrote to memory of 1988 3000 1df6b8284f2ee66d546efa938f571765.exe 28 PID 3000 wrote to memory of 1988 3000 1df6b8284f2ee66d546efa938f571765.exe 28 PID 3000 wrote to memory of 1988 3000 1df6b8284f2ee66d546efa938f571765.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1df6b8284f2ee66d546efa938f571765.exe"C:\Users\Admin\AppData\Local\Temp\1df6b8284f2ee66d546efa938f571765.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe relaunch2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD560995d04e55f8d138cf5183e95942906
SHA1d90f51dd6705b94d7d3915dad623f61a7654a410
SHA25605b3464493d500473e1370aafd8c0b8db1678bd38353237141997607caf5c132
SHA5123886ba8025d96b3ba1522def75b997aec503505c14ec3364bba93fa8a5509c792b44bc67a9afbfcc4af9047bad69ae7c9dfd61ec094079cf7ddf3838704af871
-
Filesize
1.1MB
MD51df6b8284f2ee66d546efa938f571765
SHA1f56428c36db6657f2b90fe691d19439cb7159013
SHA2562001fa457ae8c2ec82ee261e185b842b622bae3ead54e68434899a182190ddbe
SHA512d6f38989469551d4f2032538043aba9a30e76d03b86d594cdc7d8736f150b2c593117aff9388d807628d7afbfdbc5edb5831dd03696d72ed724d986145c5f8c4