Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 23:19
Static task
static1
Behavioral task
behavioral1
Sample
1fcb7f6579861abcffd42107db1a39e1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1fcb7f6579861abcffd42107db1a39e1.exe
Resource
win10v2004-20231222-en
General
-
Target
1fcb7f6579861abcffd42107db1a39e1.exe
-
Size
379KB
-
MD5
1fcb7f6579861abcffd42107db1a39e1
-
SHA1
575ecdc4e776629b9323c9b5f3196ace263f0a0e
-
SHA256
e0386ae13019c472c237a857551739317fc1d3e5e53739d64e8ecf1e1a4e0515
-
SHA512
fb837591d554a0f6b65203e1bab7ec89f1aea2caec61bdb8e4843c8e6bd7e4aaf64e278a1a46239d4c0a9e79a586b17deef4afcb39ab1f8a6f9f66e5209b13e2
-
SSDEEP
6144:ErltuCNt71/p7j+WSxbC8WRyhBktENi3rOZpwVcGwK+dZKuLdNGftq:EZtuiJNkxbC/jtEEkakMt
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2936 eNnDa06511.exe -
Loads dropped DLL 1 IoCs
pid Process 3008 1fcb7f6579861abcffd42107db1a39e1.exe -
resource yara_rule behavioral1/memory/3008-1-0x0000000000400000-0x00000000004B49F7-memory.dmp upx behavioral1/memory/3008-8-0x0000000000400000-0x00000000004B49F7-memory.dmp upx behavioral1/memory/2936-14-0x0000000000400000-0x00000000004B49F7-memory.dmp upx behavioral1/memory/2936-20-0x0000000000400000-0x00000000004B49F7-memory.dmp upx behavioral1/memory/2936-31-0x0000000000400000-0x00000000004B49F7-memory.dmp upx behavioral1/memory/2936-37-0x0000000000400000-0x00000000004B49F7-memory.dmp upx behavioral1/memory/3008-40-0x0000000000400000-0x00000000004B49F7-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eNnDa06511 = "C:\\ProgramData\\eNnDa06511\\eNnDa06511.exe" eNnDa06511.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main eNnDa06511.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3008 1fcb7f6579861abcffd42107db1a39e1.exe Token: SeDebugPrivilege 2936 eNnDa06511.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2936 eNnDa06511.exe 2936 eNnDa06511.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2936 eNnDa06511.exe 2936 eNnDa06511.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2936 eNnDa06511.exe 2936 eNnDa06511.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2936 3008 1fcb7f6579861abcffd42107db1a39e1.exe 28 PID 3008 wrote to memory of 2936 3008 1fcb7f6579861abcffd42107db1a39e1.exe 28 PID 3008 wrote to memory of 2936 3008 1fcb7f6579861abcffd42107db1a39e1.exe 28 PID 3008 wrote to memory of 2936 3008 1fcb7f6579861abcffd42107db1a39e1.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fcb7f6579861abcffd42107db1a39e1.exe"C:\Users\Admin\AppData\Local\Temp\1fcb7f6579861abcffd42107db1a39e1.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\ProgramData\eNnDa06511\eNnDa06511.exe"C:\ProgramData\eNnDa06511\eNnDa06511.exe" "C:\Users\Admin\AppData\Local\Temp\1fcb7f6579861abcffd42107db1a39e1.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
379KB
MD51a8946c2cbe6a754631d7ac6d04f1591
SHA121b1c0eea3fa3168cfec2a9672eb3eef50aa3d6b
SHA256791306ad265917c11e439bb8e32e3dbda0579b568895f585f4bd33e3f7d61c3d
SHA51217faabd97473d58e22c41f0586797482e7e46f6e7f6b040f10776ed90264269154fef77a2f2e48f2e5e67cbe2cfafaa6e0dcee3a74a6668b4c54cd573449d021