Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 04:13
Static task
static1
Behavioral task
behavioral1
Sample
0e10a03bd2687c8f38e91c4d47d24d6c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0e10a03bd2687c8f38e91c4d47d24d6c.exe
Resource
win10v2004-20231222-en
General
-
Target
0e10a03bd2687c8f38e91c4d47d24d6c.exe
-
Size
430KB
-
MD5
0e10a03bd2687c8f38e91c4d47d24d6c
-
SHA1
aae601d242f4a05ba266493802a8be45bb26a09b
-
SHA256
47107a8eec31993d29c3dae15f72432d3b56df1720a2b00fa143b2ee423422dd
-
SHA512
1f3997b8c9244ae33f66d662456dd872a4de09efedb5120fc21aa9b6c30d96919a9daa0af2b445e1e81ce10b13445039b59a97f2ce58f1085975336a23f2bba6
-
SSDEEP
12288:ibee0PGl89WazvzkmMxM+ltxQMAn0Iv1b70ZSf2M:2edGBazvZMHltxtIv1bUS+M
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winder.lnk 0e10a03bd2687c8f38e91c4d47d24d6c.exe -
Loads dropped DLL 1 IoCs
pid Process 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\0e10a03bd2687c8f38e91c4d47d24d6c.exe = "C:\\System32\\0e10a03bd2687c8f38e91c4d47d24d6c.exe" 0e10a03bd2687c8f38e91c4d47d24d6c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2140 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe 16 PID 2040 wrote to memory of 2140 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe 16 PID 2040 wrote to memory of 2140 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe 16 PID 2040 wrote to memory of 2140 2040 0e10a03bd2687c8f38e91c4d47d24d6c.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e10a03bd2687c8f38e91c4d47d24d6c.exe"C:\Users\Admin\AppData\Local\Temp\0e10a03bd2687c8f38e91c4d47d24d6c.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS1.vbs"2⤵PID:2140
-