Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 00:55
Behavioral task
behavioral1
Sample
093735edf11dac4f8ec9a7c61d959ad6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
093735edf11dac4f8ec9a7c61d959ad6.exe
Resource
win10v2004-20231215-en
General
-
Target
093735edf11dac4f8ec9a7c61d959ad6.exe
-
Size
195KB
-
MD5
093735edf11dac4f8ec9a7c61d959ad6
-
SHA1
8eec2dde0b66f59fd6cc2206d9b6f3511c46689a
-
SHA256
00d785bad69f12e0838413acebeb6bf9b1784a9d004b61698b27c69f6b174bdc
-
SHA512
4ea6a46568c45be21f7393bf2160afc0ec2e7b9b7f6b2fc0d8d300cc9d3dde58e2aca1d3faede156fadbda8d3534eec010fc766352f3fac15aab709be69de1df
-
SSDEEP
6144:AE06JW+MfwCQUkyBDsQprPSkrRUdKB5Ki45QlcN:AF6bMjmyBAGbX2Yf45YcN
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe" 093735edf11dac4f8ec9a7c61d959ad6.exe -
Executes dropped EXE 1 IoCs
pid Process 2836 ttfjfb.exe -
Loads dropped DLL 2 IoCs
pid Process 1472 093735edf11dac4f8ec9a7c61d959ad6.exe 1472 093735edf11dac4f8ec9a7c61d959ad6.exe -
resource yara_rule behavioral1/memory/1472-2-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1472-1-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/files/0x0011000000015c41-18.dat upx behavioral1/memory/2836-20-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/1472-12-0x0000000000230000-0x000000000024E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "C:\\Users\\Admin\\ttfjfb.exe \\u" 093735edf11dac4f8ec9a7c61d959ad6.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\secupdat.dat 093735edf11dac4f8ec9a7c61d959ad6.exe File created C:\Windows\SysWOW64\secupdat.dat 093735edf11dac4f8ec9a7c61d959ad6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1472 wrote to memory of 2836 1472 093735edf11dac4f8ec9a7c61d959ad6.exe 30 PID 1472 wrote to memory of 2836 1472 093735edf11dac4f8ec9a7c61d959ad6.exe 30 PID 1472 wrote to memory of 2836 1472 093735edf11dac4f8ec9a7c61d959ad6.exe 30 PID 1472 wrote to memory of 2836 1472 093735edf11dac4f8ec9a7c61d959ad6.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\093735edf11dac4f8ec9a7c61d959ad6.exe"C:\Users\Admin\AppData\Local\Temp\093735edf11dac4f8ec9a7c61d959ad6.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\0853.bat" "2⤵PID:2116
-
-
C:\Users\Admin\ttfjfb.exe\u2⤵
- Executes dropped EXE
PID:2836 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:2200
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103B
MD5749c8765b2efd0d8d70ba482ef579338
SHA12c18d44f941c94eaa8cf80818ca2130383b84980
SHA256133eec83386d62a921b921a786b08f62471f5fb1c5a321fba621338fd57ef05b
SHA512a80d04fd045c785b0d5d340efbbfec335fa9412258c813809d4033de8a5f825d78fc97a80b827f2fbe5fc437020009d9a77af96c824d81e754a036aef0be8ba8
-
Filesize
18KB
MD537a74e95fd4ecaaa3048e1f05dc55280
SHA1d8bc42cb8b9c04a9b993f7b98b43251d107bff59
SHA256dfbe244d8100090dcac04b6f254381f2a322814281f27b1ac1da326634421f83
SHA512337de5a38fff8dc2ee46d7c68fa5afbd50e69154d446ddad7acabe0270c56d1bd26146151922a804990b12f3ab983ebe6f747d947135cfb1ceb9e83fbe5e2530
-
Filesize
44KB
MD5d3e60058140956006eb1b5fc7a16aadb
SHA1859ce6612957d444c4799aadc96053db929ce2f9
SHA2560d441d98d8e1e0406a7794a96378a73aa6c052f32192efabc77a1c3ab72578ec
SHA5124daf8640316aa30519b05aee4697ebd941688acfbd9f719bdcdb3377ab4cd16acd7b83b6d746c7a67cfa60e13413b78e50af5d9a1e4eadd7313c699047da9982