Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
11b856128f5282fb991b02f3ac007ade.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
11b856128f5282fb991b02f3ac007ade.exe
Resource
win10v2004-20231215-en
General
-
Target
11b856128f5282fb991b02f3ac007ade.exe
-
Size
68KB
-
MD5
11b856128f5282fb991b02f3ac007ade
-
SHA1
fa2d35b939402c591a2e3fe6ab9cb21bf1a845aa
-
SHA256
83b5efe38cc3f8881a96fbb114f18fece3f9f3e74806fb48b1610bb90b6b452c
-
SHA512
e6460efbe7cea2c76e51ce3e74da347fa0076eede5971798771a9de34d0b136bd4f1900c6ee2de42db8eeca1add5d93670e35da736425d97a7a4f5f80e02ce48
-
SSDEEP
768:ITDDn3f3KK58yH8NiZtFlzbIMaJycQWp48V5wh9XnUn585JTvjfOR:ITPvKE8m8gPoqWpNTwh9XnA8517fOR
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2720 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1080 11b856128f5282fb991b02f3ac007ade.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\midaeghDrv.dll 11b856128f5282fb991b02f3ac007ade.exe File created C:\Windows\SysWOW64\midaeghDrv.dll 11b856128f5282fb991b02f3ac007ade.exe -
Modifies registry class 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6ECB0BE8-933C-91D2-C901-9A11EA15121A}\InProcServer32\ThreadingModel = "Apartment" 11b856128f5282fb991b02f3ac007ade.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{6ECB0BE8-933C-91D2-C901-9A11EA15121A}\InProcServer32 11b856128f5282fb991b02f3ac007ade.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 11b856128f5282fb991b02f3ac007ade.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 11b856128f5282fb991b02f3ac007ade.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\ 11b856128f5282fb991b02f3ac007ade.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6ECB0BE8-933C-91D2-C901-9A11EA15121A} 11b856128f5282fb991b02f3ac007ade.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6ECB0BE8-933C-91D2-C901-9A11EA15121A}\InProcServer32 11b856128f5282fb991b02f3ac007ade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6ECB0BE8-933C-91D2-C901-9A11EA15121A}\InProcServer32\ = "C:\\Windows\\SysWow64\\midaeghDrv.dll" 11b856128f5282fb991b02f3ac007ade.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeSystemtimePrivilege 1080 11b856128f5282fb991b02f3ac007ade.exe Token: SeSystemtimePrivilege 1080 11b856128f5282fb991b02f3ac007ade.exe Token: SeSystemtimePrivilege 1080 11b856128f5282fb991b02f3ac007ade.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1080 11b856128f5282fb991b02f3ac007ade.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1080 wrote to memory of 2720 1080 11b856128f5282fb991b02f3ac007ade.exe 28 PID 1080 wrote to memory of 2720 1080 11b856128f5282fb991b02f3ac007ade.exe 28 PID 1080 wrote to memory of 2720 1080 11b856128f5282fb991b02f3ac007ade.exe 28 PID 1080 wrote to memory of 2720 1080 11b856128f5282fb991b02f3ac007ade.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\11b856128f5282fb991b02f3ac007ade.exe"C:\Users\Admin\AppData\Local\Temp\11b856128f5282fb991b02f3ac007ade.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.execmd /c cas.bat2⤵
- Deletes itself
PID:2720
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190B
MD51a1364796fc1961375a359bfba770802
SHA1df502e9dfbca5ae59cddbcd44ea2439168eb2248
SHA25647375aff4623478dadaff1d72ca0960516d6d15f38e6f1da9c21c03467f6d406
SHA512ce0045b4d83b6cc65ab4432d29f5d9607658a73780e631db1fabfcb7a4a47362615329a6302ec2041bcdaeb53140e793a2c7b31b772fb2f547d29da58b43f36c
-
Filesize
44KB
MD53107cc9af676b231567378f5d7ba329d
SHA14443a747b70e353772419fcdf8587cc06c6bdec8
SHA25607d0e7ea82b1395a5f8101392b0ca26e46e9b91592c29c13806cffdf55b63118
SHA51282bf1f04a77e1fa2155b4d0586ea252fa775207aaac1bf679c44db2482d524841af979ab4ea18d1582157a42f159af78859bdaca9dc5e7232aa9e80731cb919b