Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 00:48
Static task
static1
Behavioral task
behavioral1
Sample
09104d1e60e897712568dbca8c54cace.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
09104d1e60e897712568dbca8c54cace.exe
Resource
win10v2004-20231215-en
General
-
Target
09104d1e60e897712568dbca8c54cace.exe
-
Size
629KB
-
MD5
09104d1e60e897712568dbca8c54cace
-
SHA1
75ac14370f0a94b57b28a21cf23b15785c31700b
-
SHA256
757e8e0d877c4f6e3ee83dcfb19b03871b2a11592db3fd2e930d6020d5a1422b
-
SHA512
72b553d55ad6195ef36df133f6b6da4fa36da25c41f786235d898cb1ea0368b1d7fb53cd9bfa1699303ed1eb6fb8dd43a7f45642508345eab5d3ee8af87b9e99
-
SSDEEP
12288:MlIFreXlWDAFWGijeZZICG5l1gx41c2obY7rwtN5yfMe:MSAO5GijeZXG5PgxqocwkUe
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2848 03VMP~1.EXE 2944 windows.exe -
Loads dropped DLL 2 IoCs
pid Process 2952 09104d1e60e897712568dbca8c54cace.exe 2952 09104d1e60e897712568dbca8c54cace.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 09104d1e60e897712568dbca8c54cace.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat windows.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\windows.exe 03VMP~1.EXE File opened for modification C:\Windows\windows.exe 03VMP~1.EXE File created C:\Windows\DELME.BAT 03VMP~1.EXE -
Modifies data under HKEY_USERS 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6\WpadDetectedUrl windows.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\WpadDecisionTime = 9075e416153bda01 windows.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6\WpadDecision = "0" windows.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6\WpadDecisionTime = 9075e416153bda01 windows.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 windows.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" windows.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings windows.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD} windows.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\WpadDecision = "0" windows.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\16-78-73-69-24-b6 windows.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6\WpadDecisionReason = "1" windows.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" windows.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix windows.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections windows.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6\WpadDecisionTime = 7071e0e4143bda01 windows.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" windows.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" windows.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad windows.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings windows.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 windows.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 windows.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\WpadNetworkName = "Network 3" windows.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 windows.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-78-73-69-24-b6 windows.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ windows.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" windows.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\WpadDecisionReason = "1" windows.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B01A5CC6-2A29-4CBA-8786-92D022EBC9FD}\WpadDecisionTime = 7071e0e4143bda01 windows.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2848 03VMP~1.EXE Token: SeDebugPrivilege 2944 windows.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2944 windows.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2848 2952 09104d1e60e897712568dbca8c54cace.exe 28 PID 2952 wrote to memory of 2848 2952 09104d1e60e897712568dbca8c54cace.exe 28 PID 2952 wrote to memory of 2848 2952 09104d1e60e897712568dbca8c54cace.exe 28 PID 2952 wrote to memory of 2848 2952 09104d1e60e897712568dbca8c54cace.exe 28 PID 2944 wrote to memory of 1704 2944 windows.exe 30 PID 2944 wrote to memory of 1704 2944 windows.exe 30 PID 2944 wrote to memory of 1704 2944 windows.exe 30 PID 2944 wrote to memory of 1704 2944 windows.exe 30 PID 2848 wrote to memory of 1392 2848 03VMP~1.EXE 31 PID 2848 wrote to memory of 1392 2848 03VMP~1.EXE 31 PID 2848 wrote to memory of 1392 2848 03VMP~1.EXE 31 PID 2848 wrote to memory of 1392 2848 03VMP~1.EXE 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\09104d1e60e897712568dbca8c54cace.exe"C:\Users\Admin\AppData\Local\Temp\09104d1e60e897712568dbca8c54cace.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\03VMP~1.EXE2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\DELME.BAT3⤵PID:1392
-
-
-
C:\Windows\windows.exeC:\Windows\windows.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵PID:1704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD57e64a0ed5d08b31b4692d9d5897c4c53
SHA16dc34000abea2ee04af907f87b56611e19141038
SHA256621e24a22f346f3f119add56207e06f5f0168b7609d2befd4e6a39de1b05f9cc
SHA51203a573c70d4fcddeb858567bead8c396149cd3505236e92aedae923e6d0e6a6f096655f8c837280627fb88e75313b422e093b51c5bfab460c9fe5b6426ab2efb
-
Filesize
197KB
MD50d2b88551c876be0320f035140101c42
SHA14fae0937ae085087062d5af0e5ea6e749a5df366
SHA256693c25186ec79bf8ab51d45031ca698316109d1116bbbcbebb5b0d84f25f5996
SHA512ea485d2b58da3fe7cb4b83ef24761a538166a90db4d5b5dd9f0aeed541ae910e684a4eeb613770329b0138f28a7e4e9be197f5671c9f5fd8da4dc850e8c81194
-
Filesize
77KB
MD594100acfc2ae822d1ce1f1a33266312f
SHA1bebef8ba8189d8ebfc40fd9c4090aad200cd57f6
SHA2567b99e1d094fcf47dd737ba7ed1b2c4fc290c6e306190e3c8e562a33e6a4bc7d6
SHA512ba9db2beca0b145410cb844edb7929fb0829e39c2ef4fd07558fd4191d8f915685225598d1e4b3ff9dd2068880ddacd1aaa55e54d94c18391104e9621f8ef802
-
Filesize
162B
MD55b55a72b3bbb2a259e579d35ebce588d
SHA1507210b1f4a6d020c71160a487962c97425af3a1
SHA256301923c7e29ee0546da3792740836d0d9640cbe3d682c0de59ec2b76438dcbfb
SHA5129dcbe10e1d166419dac2f9b168a6e4c70ee82e9831f6629e1f3ce81c2864e3994b0952e73784b4c4c7dcf333ed9e72449f82c9b800312440c71d21cf305eb40b
-
Filesize
160KB
MD51025be2f42f35a71f0d63d34a11b5af5
SHA1026e6285ff0708e9ad37ed9d06c4b215ff419ae7
SHA256d5a526a8a9cdadff5e04fd71d9d29b437ef510de5e8bc7f6ae83a1f21ba9371c
SHA51293d7ed43039016c2c33fc115b36f26896daec3a88bec3213d9f6eb45d4e54badc72b44093192a958fd5b31235d41540f1aa6c681721a74facbf48b7db9381315
-
Filesize
311KB
MD5efda3ec8420d0caa4f238ecff9e4796b
SHA1a2ef5df4ad2f6922409b4d8e07af847df0425ff6
SHA2560f3b99e0b17f4b4497023e15c061405b778b834aa474e3d7fa2279e3d6a78864
SHA512f11057aadf6bfce08c3c98fbdb07403e30ddf9c0b90781ff1d027d152ea11ab455baef23826e4c388310e9183b3b726a6560f028d301fb1a432e65ae35427f00
-
Filesize
292KB
MD5ff92b8b13512e835b2b7a63de25500e5
SHA1434061b8da121068ec7cc27fb3052a7a1ec444d0
SHA25646f36adbea3cb13ea865f771ad42127661afa83e7276504e3fef51668ccb7fdd
SHA512008f9653ab1c52368a5b1963912110ba069dbd0a73fedb7244be669dc4445cc89df9dc37fb15b6ba9bfaf4d2502991c7ab216dc0bf31954a1f7a33275890f08f