Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 02:28
Static task
static1
Behavioral task
behavioral1
Sample
247a544f14c380f3924cceb344686691.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
247a544f14c380f3924cceb344686691.exe
Resource
win10v2004-20231215-en
General
-
Target
247a544f14c380f3924cceb344686691.exe
-
Size
3.2MB
-
MD5
247a544f14c380f3924cceb344686691
-
SHA1
7b353645b5880790ef03683bcc2720a8f2e7d192
-
SHA256
98e8f71ab0674cef74477f1b292711431a12486603d9bf86fa8b518e04abcb25
-
SHA512
ce964efad1e8c0286bdce55246b88c5f02148e40356d59b37b13e80c26029ba77bc86ea7692aad3591620ef313bd77d4e23602610c749bc121e2bfdc3b365892
-
SSDEEP
3072:1cZort5+RRDCRqfrcD+/gcloaVwaJ6z1UaJLPkwgI2Yx7uuaNeZ03+:1ciKR3FcOekwDxSxeZM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2324 $Recycle$.exe -
Loads dropped DLL 2 IoCs
pid Process 2360 247a544f14c380f3924cceb344686691.exe 2360 247a544f14c380f3924cceb344686691.exe -
resource yara_rule behavioral1/memory/2360-2-0x0000000000400000-0x000000000073C000-memory.dmp upx behavioral1/memory/2324-15-0x0000000000400000-0x000000000073C000-memory.dmp upx behavioral1/memory/2360-97-0x0000000000400000-0x000000000073C000-memory.dmp upx behavioral1/memory/2324-100-0x0000000002C70000-0x0000000002E34000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\$Recycle$.exe = "C:\\$Recycle$\\$Recycle$.exe" $Recycle$.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" $Recycle$.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PhishingFilter $Recycle$.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" $Recycle$.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" $Recycle$.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery $Recycle$.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2360 247a544f14c380f3924cceb344686691.exe 2360 247a544f14c380f3924cceb344686691.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe 2324 $Recycle$.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2360 247a544f14c380f3924cceb344686691.exe Token: SeDebugPrivilege 2360 247a544f14c380f3924cceb344686691.exe Token: SeDebugPrivilege 2360 247a544f14c380f3924cceb344686691.exe Token: SeDebugPrivilege 2360 247a544f14c380f3924cceb344686691.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe Token: SeDebugPrivilege 2324 $Recycle$.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1196 2360 247a544f14c380f3924cceb344686691.exe 11 PID 2360 wrote to memory of 380 2360 247a544f14c380f3924cceb344686691.exe 4 PID 2360 wrote to memory of 420 2360 247a544f14c380f3924cceb344686691.exe 3 PID 2360 wrote to memory of 480 2360 247a544f14c380f3924cceb344686691.exe 1 PID 2360 wrote to memory of 488 2360 247a544f14c380f3924cceb344686691.exe 26 PID 2360 wrote to memory of 584 2360 247a544f14c380f3924cceb344686691.exe 8 PID 2360 wrote to memory of 660 2360 247a544f14c380f3924cceb344686691.exe 25 PID 2360 wrote to memory of 732 2360 247a544f14c380f3924cceb344686691.exe 24 PID 2360 wrote to memory of 808 2360 247a544f14c380f3924cceb344686691.exe 23 PID 2360 wrote to memory of 848 2360 247a544f14c380f3924cceb344686691.exe 22 PID 2360 wrote to memory of 992 2360 247a544f14c380f3924cceb344686691.exe 21 PID 2360 wrote to memory of 344 2360 247a544f14c380f3924cceb344686691.exe 20 PID 2360 wrote to memory of 300 2360 247a544f14c380f3924cceb344686691.exe 10 PID 2360 wrote to memory of 1060 2360 247a544f14c380f3924cceb344686691.exe 19 PID 2360 wrote to memory of 1108 2360 247a544f14c380f3924cceb344686691.exe 18 PID 2360 wrote to memory of 1172 2360 247a544f14c380f3924cceb344686691.exe 17 PID 2360 wrote to memory of 1196 2360 247a544f14c380f3924cceb344686691.exe 11 PID 2360 wrote to memory of 612 2360 247a544f14c380f3924cceb344686691.exe 15 PID 2360 wrote to memory of 1388 2360 247a544f14c380f3924cceb344686691.exe 12 PID 2360 wrote to memory of 1860 2360 247a544f14c380f3924cceb344686691.exe 14 PID 2360 wrote to memory of 2324 2360 247a544f14c380f3924cceb344686691.exe 28 PID 2360 wrote to memory of 2324 2360 247a544f14c380f3924cceb344686691.exe 28 PID 2360 wrote to memory of 2324 2360 247a544f14c380f3924cceb344686691.exe 28 PID 2360 wrote to memory of 2324 2360 247a544f14c380f3924cceb344686691.exe 28 PID 2324 wrote to memory of 1196 2324 $Recycle$.exe 11 PID 2324 wrote to memory of 380 2324 $Recycle$.exe 4 PID 2324 wrote to memory of 420 2324 $Recycle$.exe 3 PID 2324 wrote to memory of 480 2324 $Recycle$.exe 1 PID 2324 wrote to memory of 488 2324 $Recycle$.exe 26 PID 2324 wrote to memory of 584 2324 $Recycle$.exe 8 PID 2324 wrote to memory of 660 2324 $Recycle$.exe 25 PID 2324 wrote to memory of 732 2324 $Recycle$.exe 24 PID 2324 wrote to memory of 808 2324 $Recycle$.exe 23 PID 2324 wrote to memory of 848 2324 $Recycle$.exe 22 PID 2324 wrote to memory of 992 2324 $Recycle$.exe 21 PID 2324 wrote to memory of 344 2324 $Recycle$.exe 20 PID 2324 wrote to memory of 300 2324 $Recycle$.exe 10 PID 2324 wrote to memory of 1060 2324 $Recycle$.exe 19 PID 2324 wrote to memory of 1108 2324 $Recycle$.exe 18 PID 2324 wrote to memory of 1172 2324 $Recycle$.exe 17 PID 2324 wrote to memory of 1196 2324 $Recycle$.exe 11 PID 2324 wrote to memory of 612 2324 $Recycle$.exe 15 PID 2324 wrote to memory of 1388 2324 $Recycle$.exe 12 PID 2324 wrote to memory of 1860 2324 $Recycle$.exe 14 PID 2324 wrote to memory of 2360 2324 $Recycle$.exe 27 PID 2324 wrote to memory of 1780 2324 $Recycle$.exe 29 PID 2324 wrote to memory of 1324 2324 $Recycle$.exe 30 PID 2324 wrote to memory of 1264 2324 $Recycle$.exe 31
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:480
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:380
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵PID:584
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:612
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}2⤵PID:1780
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding2⤵PID:1264
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:300
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\247a544f14c380f3924cceb344686691.exe"C:\Users\Admin\AppData\Local\Temp\247a544f14c380f3924cceb344686691.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\$Recycle$\$Recycle$.exe"C:\$Recycle$\$Recycle$.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵PID:1388
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵PID:1860
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵PID:1060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵PID:344
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:992
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:848
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:1324
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵PID:808
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵PID:660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5247a544f14c380f3924cceb344686691
SHA17b353645b5880790ef03683bcc2720a8f2e7d192
SHA25698e8f71ab0674cef74477f1b292711431a12486603d9bf86fa8b518e04abcb25
SHA512ce964efad1e8c0286bdce55246b88c5f02148e40356d59b37b13e80c26029ba77bc86ea7692aad3591620ef313bd77d4e23602610c749bc121e2bfdc3b365892