Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
12255519906f8e866bec93da7a1a3794.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
12255519906f8e866bec93da7a1a3794.exe
Resource
win10v2004-20231215-en
General
-
Target
12255519906f8e866bec93da7a1a3794.exe
-
Size
58KB
-
MD5
12255519906f8e866bec93da7a1a3794
-
SHA1
d539c3b58dcef517cf7f4175431716e18723596a
-
SHA256
b9e21cf406067cab25e3f3ffa75d36f64990ed4ec9cee093caa862d92ac74d31
-
SHA512
ec7bb0845fd15d26cf93742f27dcb967c6b679c1608875120eda8b809566db8dd70204b494e5fe7fb9d6f33f3480990ddd00996b7b7fe88d69e8179778313d2a
-
SSDEEP
768:1zxzTK0TzGEabuRixyRVMkLOZM1KRgcxlPnJzAN7W1+ZhVSpHGStXxUe+WL8on:1zTL/RiofLOO10dHnZ8WAZhwpHxrsLQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2776 iexplore.exe -
Loads dropped DLL 2 IoCs
pid Process 2360 12255519906f8e866bec93da7a1a3794.exe 2360 12255519906f8e866bec93da7a1a3794.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssysint = "iexplore.exe" 12255519906f8e866bec93da7a1a3794.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\iexplore.exe 12255519906f8e866bec93da7a1a3794.exe File opened for modification C:\Windows\SysWOW64\iexplore.exe 12255519906f8e866bec93da7a1a3794.exe File created C:\Windows\SysWOW64\psinthk.dll 12255519906f8e866bec93da7a1a3794.exe File created C:\Windows\SysWOW64\iexplore.exe iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2360 12255519906f8e866bec93da7a1a3794.exe 2360 12255519906f8e866bec93da7a1a3794.exe 2776 iexplore.exe 2776 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2776 2360 12255519906f8e866bec93da7a1a3794.exe 23 PID 2360 wrote to memory of 2776 2360 12255519906f8e866bec93da7a1a3794.exe 23 PID 2360 wrote to memory of 2776 2360 12255519906f8e866bec93da7a1a3794.exe 23 PID 2360 wrote to memory of 2776 2360 12255519906f8e866bec93da7a1a3794.exe 23
Processes
-
C:\Users\Admin\AppData\Local\Temp\12255519906f8e866bec93da7a1a3794.exe"C:\Users\Admin\AppData\Local\Temp\12255519906f8e866bec93da7a1a3794.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\iexplore.exeC:\Windows\system32\iexplore.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD59e40f2eb649a5bcdd1e9e4ff284c2fd0
SHA16a760ef7468dbdc1b14e56c4fb56307b9c42d619
SHA2568ec3b406ef6d8940dea01829ac4a05384102fb7393d3101dade52a0474cc6b6f
SHA5127b7477a60846a5e31a471c06a36dc0988e2a488ab3e0e7230a3ce738b4ce4037f276fe5b9fe42f2c29afc65507696407c6b04e203397a71b6ec238c1f761ca7a
-
Filesize
56KB
MD5ac892012dbb7e9a7c4085364696c7e85
SHA115eac858590496109ce654293abd1455f2df8077
SHA2564aaa475fc37c82abca8f65ebdfddd9cc96bf69348eb279ee9241003e4bf41eb9
SHA512cd285a201c636c63eed3e9b57ab246768656590ce5354a35c2375bd5e62235ca1ee8b323467b715254eb3ff86ba76a8336cb416ef5a075021769852a8a505c90
-
Filesize
58KB
MD512255519906f8e866bec93da7a1a3794
SHA1d539c3b58dcef517cf7f4175431716e18723596a
SHA256b9e21cf406067cab25e3f3ffa75d36f64990ed4ec9cee093caa862d92ac74d31
SHA512ec7bb0845fd15d26cf93742f27dcb967c6b679c1608875120eda8b809566db8dd70204b494e5fe7fb9d6f33f3480990ddd00996b7b7fe88d69e8179778313d2a