Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
177s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 13:36
Static task
static1
Behavioral task
behavioral1
Sample
1a365b3dd9a3b049814b3e4ad813c4d8.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1a365b3dd9a3b049814b3e4ad813c4d8.exe
Resource
win10v2004-20231215-en
General
-
Target
1a365b3dd9a3b049814b3e4ad813c4d8.exe
-
Size
1.6MB
-
MD5
1a365b3dd9a3b049814b3e4ad813c4d8
-
SHA1
4eed488cb6e8d66dbffd3eb6481e91de9830025c
-
SHA256
3311fbb32acf6d00f0998e557f0a6ef7c1586232586a9069601db9ad72e7d59f
-
SHA512
63d655bdda4fe599b1d24b35b448039db872e323caff112203b35614068cd2f77aeac16cadfbb1cfa1ad221c270434bcd39f2608e59ec4b1241099f1ad8c4f67
-
SSDEEP
12288:blIX21g+kD1t5m1HX71j2TzgNOe099zUdcVlNPu90eDDJph:u5+kRt5mVXBczgNP099zUa1K0Sh
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" 1a365b3dd9a3b049814b3e4ad813c4d8.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 1a365b3dd9a3b049814b3e4ad813c4d8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" 1a365b3dd9a3b049814b3e4ad813c4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" services.exe -
Modifies Installed Components in the registry 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" services.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} 1a365b3dd9a3b049814b3e4ad813c4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ 1a365b3dd9a3b049814b3e4ad813c4d8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" 1a365b3dd9a3b049814b3e4ad813c4d8.exe -
Executes dropped EXE 2 IoCs
pid Process 4852 fservice.exe 2796 services.exe -
Loads dropped DLL 3 IoCs
pid Process 2796 services.exe 2796 services.exe 2796 services.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 1a365b3dd9a3b049814b3e4ad813c4d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ services.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\fservice.exe-up.txt fservice.exe File created C:\Windows\SysWOW64\fservice.exe fservice.exe File opened for modification C:\Windows\SysWOW64\fservice.exe fservice.exe File created C:\Windows\SysWOW64\winkey.dll services.exe File created C:\Windows\SysWOW64\reginv.dll services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe File created C:\Windows\SysWOW64\fservice.exe 1a365b3dd9a3b049814b3e4ad813c4d8.exe File opened for modification C:\Windows\SysWOW64\fservice.exe 1a365b3dd9a3b049814b3e4ad813c4d8.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe 1a365b3dd9a3b049814b3e4ad813c4d8.exe File opened for modification C:\Windows\system\sservice.exe 1a365b3dd9a3b049814b3e4ad813c4d8.exe File created C:\Windows\services.exe fservice.exe File opened for modification C:\Windows\services.exe fservice.exe File created C:\Windows\system\sservice.exe fservice.exe File opened for modification C:\Windows\system\sservice.exe fservice.exe File created C:\Windows\services.exe-up.txt services.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe 2796 services.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2796 services.exe 2796 services.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3500 wrote to memory of 4852 3500 1a365b3dd9a3b049814b3e4ad813c4d8.exe 95 PID 3500 wrote to memory of 4852 3500 1a365b3dd9a3b049814b3e4ad813c4d8.exe 95 PID 3500 wrote to memory of 4852 3500 1a365b3dd9a3b049814b3e4ad813c4d8.exe 95 PID 4852 wrote to memory of 2796 4852 fservice.exe 96 PID 4852 wrote to memory of 2796 4852 fservice.exe 96 PID 4852 wrote to memory of 2796 4852 fservice.exe 96 PID 2796 wrote to memory of 1900 2796 services.exe 97 PID 2796 wrote to memory of 1900 2796 services.exe 97 PID 2796 wrote to memory of 1900 2796 services.exe 97 PID 2796 wrote to memory of 1808 2796 services.exe 98 PID 2796 wrote to memory of 1808 2796 services.exe 98 PID 2796 wrote to memory of 1808 2796 services.exe 98 PID 1900 wrote to memory of 624 1900 NET.exe 102 PID 1900 wrote to memory of 624 1900 NET.exe 102 PID 1900 wrote to memory of 624 1900 NET.exe 102 PID 1808 wrote to memory of 4968 1808 NET.exe 101 PID 1808 wrote to memory of 4968 1808 NET.exe 101 PID 1808 wrote to memory of 4968 1808 NET.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a365b3dd9a3b049814b3e4ad813c4d8.exe"C:\Users\Admin\AppData\Local\Temp\1a365b3dd9a3b049814b3e4ad813c4d8.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\fservice.exeC:\Windows\system32\fservice.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\services.exeC:\Windows\services.exe -XP3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\NET.exeNET STOP srservice4⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP srservice5⤵PID:624
-
-
-
C:\Windows\SysWOW64\NET.exeNET STOP navapsvc4⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP navapsvc5⤵PID:4968
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD51a365b3dd9a3b049814b3e4ad813c4d8
SHA14eed488cb6e8d66dbffd3eb6481e91de9830025c
SHA2563311fbb32acf6d00f0998e557f0a6ef7c1586232586a9069601db9ad72e7d59f
SHA51263d655bdda4fe599b1d24b35b448039db872e323caff112203b35614068cd2f77aeac16cadfbb1cfa1ad221c270434bcd39f2608e59ec4b1241099f1ad8c4f67
-
Filesize
36KB
MD5d4a3f90e159ffbcbc4f9740de4b7f171
SHA10542f5d1e2c23dca8d90766b3a8537dc3880e5c9
SHA2562200dd5f83d2fb8c5d3994206a4fa9ff34b4cbfe56ed39a9a03c954cf45d8f77
SHA5125493beb50b5f7d8ec52f32718d01696916ae173456005d0c1294ce695161ce5004aff58ee3892bf5db0f9b23720146a6d3ae8ffbcbbd81f84d894fdc8cf75a94
-
Filesize
24KB
MD543e7d9b875c921ba6be38d45540fb9dd
SHA1f22a73fc0d4aa3ea6c0b8f61d974b028f308acc4
SHA256f1b2b0abe844e6ba812c7f8709a463a7f6c56fa6ac38d376a0739cc3469f795b
SHA5122e74e23c0875b69b82319391c392132f28f4eb45aa412805130382498ae48969a06a2b3a7528b626fa7d7ddb6b006f19f0ef8d73cf73cb9a0c0df44a21077622