Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 00:21
Behavioral task
behavioral1
Sample
08614fa7eccc14f39a2e5676d697cf2d.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
General
-
Target
08614fa7eccc14f39a2e5676d697cf2d.exe
-
Size
2.2MB
-
MD5
08614fa7eccc14f39a2e5676d697cf2d
-
SHA1
6474125a0cc6f37c2f9aa072b130b83d8301dc4a
-
SHA256
93f2621353ac918ab9adfaac4711a536025174864828f4ef738c45a3bdc28cb5
-
SHA512
8c3011004cca51ed6ae7a5008a5879d16f2e75138a05430207c02f4e3d75a1acf869d8706b0262796dc1d895adbb488ce16190f39a4c55a78e1bc836b2ef81f0
-
SSDEEP
49152:dEVUc5iEVUc5vEVUc5xEVUc5JEVUc5ZEVUc5cEZ:dE35iE35vE35xE35JE35ZE35cEZ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2452 svhost.exe -
resource yara_rule behavioral1/memory/828-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x000a000000012022-4.dat upx behavioral1/memory/828-5-0x0000000003250000-0x0000000003373000-memory.dmp upx behavioral1/memory/2452-46-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/files/0x0030000000015c83-67.dat upx behavioral1/memory/828-650-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral1/memory/2452-2589-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\y: svhost.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2452-46-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/828-650-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral1/memory/2452-2589-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 08614fa7eccc14f39a2e5676d697cf2d.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2452 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 828 08614fa7eccc14f39a2e5676d697cf2d.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 828 08614fa7eccc14f39a2e5676d697cf2d.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 828 08614fa7eccc14f39a2e5676d697cf2d.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe 2452 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 828 wrote to memory of 2452 828 08614fa7eccc14f39a2e5676d697cf2d.exe 28 PID 828 wrote to memory of 2452 828 08614fa7eccc14f39a2e5676d697cf2d.exe 28 PID 828 wrote to memory of 2452 828 08614fa7eccc14f39a2e5676d697cf2d.exe 28 PID 828 wrote to memory of 2452 828 08614fa7eccc14f39a2e5676d697cf2d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\08614fa7eccc14f39a2e5676d697cf2d.exe"C:\Users\Admin\AppData\Local\Temp\08614fa7eccc14f39a2e5676d697cf2d.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2452
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5bcd9b195d842b47b7c9f6f3ff91da876
SHA1f88c20033b1e1c9647203271654429716870a22f
SHA25632614b5cc02e993b950eae1c0f3cb6da0b281469f8a8fee3594260cc77d32543
SHA51249bee7ce58f7b6b7414ef4e02d2b927eb63d9f68a008c26d4547e140a8801c922cc6c2209aff67c34ad27a3c5cb793d45f364262b391c37e446c9835f3e36243
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
2.2MB
MD5accdcf43ef11f63cf553186ec8823a85
SHA144191d9e8e984bc95c30f172f3daaa3717b8b4ab
SHA2563870c9c69a5afe309382e8f029a5912bed6d50c932aff5312d7cd6362b325652
SHA5123eee781ea1c294352ada0811da05233bbe1e8db0d4161409f9c46f6f0dd1b18f7f8439082426962858a7d1a858e4e90df57e58afda88fd4e72ee80c369e6aad6