Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 23:56
Static task
static1
Behavioral task
behavioral1
Sample
20c503c484e99229556500b2605870dd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
20c503c484e99229556500b2605870dd.exe
Resource
win10v2004-20231215-en
General
-
Target
20c503c484e99229556500b2605870dd.exe
-
Size
1.1MB
-
MD5
20c503c484e99229556500b2605870dd
-
SHA1
9691c390ff911f3c06fc763acdd459a0503d562f
-
SHA256
21fe00222e35f2577acbd61728d4d90d7941e9cbe1339c7da4a38a5516af536a
-
SHA512
5ef225bdb937e5b12f81b97f19435ef4ad433fbed8e4653a1ea1e74e1e158f39732498ce3097758751d3b209b6b6bf51c76f9c03c122ef1b456ddaabd1742ece
-
SSDEEP
24576:rWvknOMEfp5iIPLzT2V7I3bUlMgYqgAnscEGCBodGlwJ/3JZKa+y:rUeOMm/TPTG7IwlWqgAscEGCqoa+y
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2096 Setup.exe -
Loads dropped DLL 4 IoCs
pid Process 2400 20c503c484e99229556500b2605870dd.exe 2096 Setup.exe 2096 Setup.exe 2096 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\Setup.exe = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS Setup.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Setup.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1" Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main Setup.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Setup.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Setup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2096 2400 20c503c484e99229556500b2605870dd.exe 28 PID 2400 wrote to memory of 2096 2400 20c503c484e99229556500b2605870dd.exe 28 PID 2400 wrote to memory of 2096 2400 20c503c484e99229556500b2605870dd.exe 28 PID 2400 wrote to memory of 2096 2400 20c503c484e99229556500b2605870dd.exe 28 PID 2400 wrote to memory of 2096 2400 20c503c484e99229556500b2605870dd.exe 28 PID 2400 wrote to memory of 2096 2400 20c503c484e99229556500b2605870dd.exe 28 PID 2400 wrote to memory of 2096 2400 20c503c484e99229556500b2605870dd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\20c503c484e99229556500b2605870dd.exe"C:\Users\Admin\AppData\Local\Temp\20c503c484e99229556500b2605870dd.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\a2IZunmB8Q\9cf56OCn\Setup.exeC:\Users\Admin\AppData\Local\Temp\a2IZunmB8Q\9cf56OCn\Setup.exe --relaunch2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
PID:2096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD520c503c484e99229556500b2605870dd
SHA19691c390ff911f3c06fc763acdd459a0503d562f
SHA25621fe00222e35f2577acbd61728d4d90d7941e9cbe1339c7da4a38a5516af536a
SHA5125ef225bdb937e5b12f81b97f19435ef4ad433fbed8e4653a1ea1e74e1e158f39732498ce3097758751d3b209b6b6bf51c76f9c03c122ef1b456ddaabd1742ece