Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 02:54
Behavioral task
behavioral1
Sample
254ffef690c9d1a5c839577786b9c813.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
254ffef690c9d1a5c839577786b9c813.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
254ffef690c9d1a5c839577786b9c813.exe
-
Size
298KB
-
MD5
254ffef690c9d1a5c839577786b9c813
-
SHA1
012a05261e1bfac02140be52eff000e69a40759b
-
SHA256
51bbd097c356f224ffcfa75ef2d0b1a08a1378a0a8e93ee9004e36b7cde8544e
-
SHA512
b307515c0a48c3e6c98e2f0f2c680a08274e5589c00db73cb1663232b004d9d0a9cb7f0bceedc66c596bd012f48c9b1317018087d87535ba280a6543f30cca20
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYD:v6Wq4aaE6KwyF5L0Y2D1PqLo
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2824 svhost.exe -
resource yara_rule behavioral1/memory/1912-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x000a000000012243-4.dat upx behavioral1/memory/2824-6-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/files/0x0008000000015d03-67.dat upx behavioral1/memory/1912-707-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-1305-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-2352-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-2610-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-3399-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-4439-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-5744-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-6783-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-7835-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-9138-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-10183-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-11228-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-12282-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-13596-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-14657-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2824-15701-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\z: svhost.exe -
AutoIT Executable 17 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2824-6-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/1912-707-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-1305-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-2352-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-2610-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-3399-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-4439-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-5744-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-6783-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-7835-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-9138-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-10183-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-11228-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-12282-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-13596-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-14657-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral1/memory/2824-15701-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 254ffef690c9d1a5c839577786b9c813.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2824 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1912 254ffef690c9d1a5c839577786b9c813.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1912 254ffef690c9d1a5c839577786b9c813.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 1912 254ffef690c9d1a5c839577786b9c813.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe 2824 svhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2824 1912 254ffef690c9d1a5c839577786b9c813.exe 28 PID 1912 wrote to memory of 2824 1912 254ffef690c9d1a5c839577786b9c813.exe 28 PID 1912 wrote to memory of 2824 1912 254ffef690c9d1a5c839577786b9c813.exe 28 PID 1912 wrote to memory of 2824 1912 254ffef690c9d1a5c839577786b9c813.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\254ffef690c9d1a5c839577786b9c813.exe"C:\Users\Admin\AppData\Local\Temp\254ffef690c9d1a5c839577786b9c813.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD50a831501cc9a67f9299fd331b7bdf9cc
SHA1057e7205a863540b8d3b85abcfb58bd210f00610
SHA25660d867db3186d4584596cfbabd58ef27bd6697513e7ade9677b2ad99bcf0f66f
SHA512e92dab1b9fba1503f8af053ffaf7fa7ee5e2a0cd796679d6a5630bd4d8d6b31387bfb3ed305b4b69520ece64de34b7e3943fd192f9fbda50ee6544239cef53a4
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD519ff3f7082ce02d8355d0f96337cf5b3
SHA190d27724d5d333804fa63341f3d09a464345eeec
SHA2561db1942080bebb0f3f26a892cbd689e8e9aedb941d38039bd0a50845a9256380
SHA512f3279f7002142f66c9acafadf1f3c647b7775f15fa119ef7317b406190075c7bf853174c819b77fef125d5b698a1b57742cd61c75308543ceb09a99e01c8aa2b