Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 00:34
Static task
static1
Behavioral task
behavioral1
Sample
21e3c9cebb346add379aeadf2d539c43.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
21e3c9cebb346add379aeadf2d539c43.exe
Resource
win10v2004-20231222-en
General
-
Target
21e3c9cebb346add379aeadf2d539c43.exe
-
Size
375KB
-
MD5
21e3c9cebb346add379aeadf2d539c43
-
SHA1
217c41d654c2c8ab4ef425a86fdd0ee961c08328
-
SHA256
e4eecda3c8f76851e33d2de079e63477ede14b6eb6e2511b141eef808f55a61d
-
SHA512
ee972b6b6d15a1d94f3c38f50074f498491351e683251e9519b4c6f970de2d0b9655b8536c01de16bba80e0e71d9f95b694f5ea0beb22a32105c816500f44b6b
-
SSDEEP
6144:8UvbxY2cqs+Iu6TzJQVW8MNkLo93utmTGlgWRx/:pG2wuVjQkLo9M+ggWRx
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2668 LlaxxHzoE2Uj.exe -
Executes dropped EXE 2 IoCs
pid Process 2184 LlaxxHzoE2Uj.exe 2668 LlaxxHzoE2Uj.exe -
Loads dropped DLL 4 IoCs
pid Process 1752 21e3c9cebb346add379aeadf2d539c43.exe 1752 21e3c9cebb346add379aeadf2d539c43.exe 1752 21e3c9cebb346add379aeadf2d539c43.exe 2668 LlaxxHzoE2Uj.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\misbM77W2LLzQ = "C:\\ProgramData\\NmgeaahyW\\LlaxxHzoE2Uj.exe" 21e3c9cebb346add379aeadf2d539c43.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2252 set thread context of 1752 2252 21e3c9cebb346add379aeadf2d539c43.exe 28 PID 2184 set thread context of 2668 2184 LlaxxHzoE2Uj.exe 30 PID 2668 set thread context of 2664 2668 LlaxxHzoE2Uj.exe 31 -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2252 wrote to memory of 1752 2252 21e3c9cebb346add379aeadf2d539c43.exe 28 PID 2252 wrote to memory of 1752 2252 21e3c9cebb346add379aeadf2d539c43.exe 28 PID 2252 wrote to memory of 1752 2252 21e3c9cebb346add379aeadf2d539c43.exe 28 PID 2252 wrote to memory of 1752 2252 21e3c9cebb346add379aeadf2d539c43.exe 28 PID 2252 wrote to memory of 1752 2252 21e3c9cebb346add379aeadf2d539c43.exe 28 PID 2252 wrote to memory of 1752 2252 21e3c9cebb346add379aeadf2d539c43.exe 28 PID 1752 wrote to memory of 2184 1752 21e3c9cebb346add379aeadf2d539c43.exe 29 PID 1752 wrote to memory of 2184 1752 21e3c9cebb346add379aeadf2d539c43.exe 29 PID 1752 wrote to memory of 2184 1752 21e3c9cebb346add379aeadf2d539c43.exe 29 PID 1752 wrote to memory of 2184 1752 21e3c9cebb346add379aeadf2d539c43.exe 29 PID 2184 wrote to memory of 2668 2184 LlaxxHzoE2Uj.exe 30 PID 2184 wrote to memory of 2668 2184 LlaxxHzoE2Uj.exe 30 PID 2184 wrote to memory of 2668 2184 LlaxxHzoE2Uj.exe 30 PID 2184 wrote to memory of 2668 2184 LlaxxHzoE2Uj.exe 30 PID 2184 wrote to memory of 2668 2184 LlaxxHzoE2Uj.exe 30 PID 2184 wrote to memory of 2668 2184 LlaxxHzoE2Uj.exe 30 PID 2668 wrote to memory of 2664 2668 LlaxxHzoE2Uj.exe 31 PID 2668 wrote to memory of 2664 2668 LlaxxHzoE2Uj.exe 31 PID 2668 wrote to memory of 2664 2668 LlaxxHzoE2Uj.exe 31 PID 2668 wrote to memory of 2664 2668 LlaxxHzoE2Uj.exe 31 PID 2668 wrote to memory of 2664 2668 LlaxxHzoE2Uj.exe 31 PID 2668 wrote to memory of 2664 2668 LlaxxHzoE2Uj.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\21e3c9cebb346add379aeadf2d539c43.exe"C:\Users\Admin\AppData\Local\Temp\21e3c9cebb346add379aeadf2d539c43.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\21e3c9cebb346add379aeadf2d539c43.exe"C:\Users\Admin\AppData\Local\Temp\21e3c9cebb346add379aeadf2d539c43.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\ProgramData\NmgeaahyW\LlaxxHzoE2Uj.exe"C:\ProgramData\NmgeaahyW\LlaxxHzoE2Uj.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\ProgramData\NmgeaahyW\LlaxxHzoE2Uj.exe"C:\ProgramData\NmgeaahyW\LlaxxHzoE2Uj.exe"4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe" /i:26685⤵PID:2664
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
375KB
MD521e3c9cebb346add379aeadf2d539c43
SHA1217c41d654c2c8ab4ef425a86fdd0ee961c08328
SHA256e4eecda3c8f76851e33d2de079e63477ede14b6eb6e2511b141eef808f55a61d
SHA512ee972b6b6d15a1d94f3c38f50074f498491351e683251e9519b4c6f970de2d0b9655b8536c01de16bba80e0e71d9f95b694f5ea0beb22a32105c816500f44b6b