Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 05:12
Static task
static1
Behavioral task
behavioral1
Sample
29840309c306d467a1a3319a0cdae275.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
29840309c306d467a1a3319a0cdae275.exe
Resource
win10v2004-20231215-en
General
-
Target
29840309c306d467a1a3319a0cdae275.exe
-
Size
324KB
-
MD5
29840309c306d467a1a3319a0cdae275
-
SHA1
bf1c5e944a2d28f7889d1e6a9cbcdda7e2af5214
-
SHA256
e30cf1b029a0c9315afe845fc67da97f5ed36d556fe036dafe1abcfa2d50caae
-
SHA512
2e6c9602524c2e1220b32d1a9ac2d6060ba2fbf3a0649e89bc04d646c0434e552a02a4541495950252eb12376fea5a5f3318b1462f0e47423d535ec23b2c54af
-
SSDEEP
1536:tOJVn4JLlfLJ0UYFqeXx57B4JN5eCD8SlNDSSvHFRiCCVGCWPaeSe+eooOoaoCoN:QV4JLlfLIl7B4JN5eI4G
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2376 Del92AE.tmp -
Executes dropped EXE 1 IoCs
pid Process 2376 Del92AE.tmp -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\WINDOWS\3323.vbs Del92AE.tmp File created C:\WINDOWS\3323.vbs 29840309c306d467a1a3319a0cdae275.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "hao.thehh.info" 29840309c306d467a1a3319a0cdae275.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "hao.thehh.info" Del92AE.tmp -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2256 2516 29840309c306d467a1a3319a0cdae275.exe 28 PID 2516 wrote to memory of 2256 2516 29840309c306d467a1a3319a0cdae275.exe 28 PID 2516 wrote to memory of 2256 2516 29840309c306d467a1a3319a0cdae275.exe 28 PID 2516 wrote to memory of 2256 2516 29840309c306d467a1a3319a0cdae275.exe 28 PID 2516 wrote to memory of 2376 2516 29840309c306d467a1a3319a0cdae275.exe 30 PID 2516 wrote to memory of 2376 2516 29840309c306d467a1a3319a0cdae275.exe 30 PID 2516 wrote to memory of 2376 2516 29840309c306d467a1a3319a0cdae275.exe 30 PID 2516 wrote to memory of 2376 2516 29840309c306d467a1a3319a0cdae275.exe 30 PID 2376 wrote to memory of 2828 2376 Del92AE.tmp 29 PID 2376 wrote to memory of 2828 2376 Del92AE.tmp 29 PID 2376 wrote to memory of 2828 2376 Del92AE.tmp 29 PID 2376 wrote to memory of 2828 2376 Del92AE.tmp 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\29840309c306d467a1a3319a0cdae275.exe"C:\Users\Admin\AppData\Local\Temp\29840309c306d467a1a3319a0cdae275.exe"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" /nologo C:\WINDOWS\3323.vbs2⤵PID:2256
-
-
C:\Users\Admin\AppData\Local\Temp\Del92AE.tmpC:\Users\Admin\AppData\Local\Temp\Del92AE.tmp 300 "C:\Users\Admin\AppData\Local\Temp\29840309c306d467a1a3319a0cdae275.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Suspicious use of WriteProcessMemory
PID:2376
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" /nologo C:\WINDOWS\3323.vbs1⤵PID:2828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
324KB
MD529840309c306d467a1a3319a0cdae275
SHA1bf1c5e944a2d28f7889d1e6a9cbcdda7e2af5214
SHA256e30cf1b029a0c9315afe845fc67da97f5ed36d556fe036dafe1abcfa2d50caae
SHA5122e6c9602524c2e1220b32d1a9ac2d6060ba2fbf3a0649e89bc04d646c0434e552a02a4541495950252eb12376fea5a5f3318b1462f0e47423d535ec23b2c54af
-
Filesize
266KB
MD51861b0d15a96f0eab78821ef09f11398
SHA19931aec4e49a4075ce680ae5e69069f506f4383c
SHA2560981eb96faa65fe1ea7afde1d97184d67970c06ed442919a1173b48e91ad5d54
SHA5122b49cf513a546e43040fe63f99adf1d4cd49510a65c04d68122e398c9e1687fd5b29094261cc5265d92b740e8ee9fad46994a97d32ce86222abc7669afd97415