Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
251f188c303a7b31b5e55e1c870eb911.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
251f188c303a7b31b5e55e1c870eb911.exe
Resource
win10v2004-20231215-en
General
-
Target
251f188c303a7b31b5e55e1c870eb911.exe
-
Size
996KB
-
MD5
251f188c303a7b31b5e55e1c870eb911
-
SHA1
8a62f4d846908103cceff598d1bac86263f8bd17
-
SHA256
f9358fc3dad20815eb001ba00fb31a392ad3c91b9a781ed8bc5aaf6ccaff6ba6
-
SHA512
9f891dd516838aa889f8c40ca7f6309b48f14332bce1373f2cd3b17a64c7154bf8fa4ed6a3f44618110f2a9a2480199bc4d72577d7d750c8e5371ab6dacc47cd
-
SSDEEP
24576:eawtVR5j34FQPkAX7VhAFkWIlWQmXEtRll79P:epxxBXBWIlvm0thBP
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2832 4.exe 1700 systen.exe -
Loads dropped DLL 2 IoCs
pid Process 2740 251f188c303a7b31b5e55e1c870eb911.exe 2740 251f188c303a7b31b5e55e1c870eb911.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 251f188c303a7b31b5e55e1c870eb911.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\system\systen.exe 4.exe File opened for modification C:\Windows\system\systen.exe 4.exe File created C:\Windows\uninstal.BAT 4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2832 4.exe Token: SeDebugPrivilege 1700 systen.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1700 systen.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2832 2740 251f188c303a7b31b5e55e1c870eb911.exe 27 PID 2740 wrote to memory of 2832 2740 251f188c303a7b31b5e55e1c870eb911.exe 27 PID 2740 wrote to memory of 2832 2740 251f188c303a7b31b5e55e1c870eb911.exe 27 PID 2740 wrote to memory of 2832 2740 251f188c303a7b31b5e55e1c870eb911.exe 27 PID 1700 wrote to memory of 2648 1700 systen.exe 29 PID 1700 wrote to memory of 2648 1700 systen.exe 29 PID 1700 wrote to memory of 2648 1700 systen.exe 29 PID 1700 wrote to memory of 2648 1700 systen.exe 29 PID 2832 wrote to memory of 1748 2832 4.exe 33 PID 2832 wrote to memory of 1748 2832 4.exe 33 PID 2832 wrote to memory of 1748 2832 4.exe 33 PID 2832 wrote to memory of 1748 2832 4.exe 33 PID 2832 wrote to memory of 1748 2832 4.exe 33 PID 2832 wrote to memory of 1748 2832 4.exe 33 PID 2832 wrote to memory of 1748 2832 4.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\251f188c303a7b31b5e55e1c870eb911.exe"C:\Users\Admin\AppData\Local\Temp\251f188c303a7b31b5e55e1c870eb911.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\uninstal.BAT3⤵PID:1748
-
-
-
C:\Windows\system\systen.exeC:\Windows\system\systen.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:2648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
616KB
MD5aee44e6a85f2e617a26b8524d4d41f8a
SHA18b87f98e1d9b57064df9cab7e18b787e5ea0f5b0
SHA2566bc78da768391c3326ab53b98629390282733595ab533eb7221a75bafabb1803
SHA5125b75fadd985b811139c82bc642072557d745e2e94ecd86f4b3e82bb001898a2197c5ff153362445b22dedce3837ef09dfce1939d96e3b425b38ea10ca648c9fd