Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3b790506f2a6039ae123c2663e43fcf6.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
3b790506f2a6039ae123c2663e43fcf6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
3b790506f2a6039ae123c2663e43fcf6.exe
-
Size
1.1MB
-
MD5
3b790506f2a6039ae123c2663e43fcf6
-
SHA1
0795420c4a2c66b34fb2a16caaab265dd888dc55
-
SHA256
c26c21ee05b241fbcce9a2ca787a120ea47013f3108b2f96e742a71d8a7ad14b
-
SHA512
1c065804e3e25ccf237f688eb7cbd0ab7ec7cdcb5fbf928d206c3f586fd9b8ed9e69b533aa2873b0d46fbf9960e103ec6fec9cb3b30a35e7ddf5ca930cb3fba7
-
SSDEEP
24576:7+QIbfPY5Beqrrel6qAh5MQwFlN0hY/jFvaX:7/IECqrClah52X00BvaX
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1772 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\95824a4a9d32c6c20d232fa8b9024775.exe 3b790506f2a6039ae123c2663e43fcf6.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\95824a4a9d32c6c20d232fa8b9024775.exe 3b790506f2a6039ae123c2663e43fcf6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\95824a4a9d32c6c20d232fa8b9024775 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3b790506f2a6039ae123c2663e43fcf6.exe\" .." 3b790506f2a6039ae123c2663e43fcf6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\95824a4a9d32c6c20d232fa8b9024775 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3b790506f2a6039ae123c2663e43fcf6.exe\" .." 3b790506f2a6039ae123c2663e43fcf6.exe -
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 3b790506f2a6039ae123c2663e43fcf6.exe File created D:\autorun.inf 3b790506f2a6039ae123c2663e43fcf6.exe File created F:\autorun.inf 3b790506f2a6039ae123c2663e43fcf6.exe File opened for modification F:\autorun.inf 3b790506f2a6039ae123c2663e43fcf6.exe File created C:\autorun.inf 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe 3912 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3912 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 3912 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 3912 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3912 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3912 wrote to memory of 1772 3912 3b790506f2a6039ae123c2663e43fcf6.exe 95 PID 3912 wrote to memory of 1772 3912 3b790506f2a6039ae123c2663e43fcf6.exe 95 PID 3912 wrote to memory of 1772 3912 3b790506f2a6039ae123c2663e43fcf6.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b790506f2a6039ae123c2663e43fcf6.exe"C:\Users\Admin\AppData\Local\Temp\3b790506f2a6039ae123c2663e43fcf6.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3b790506f2a6039ae123c2663e43fcf6.exe" "3b790506f2a6039ae123c2663e43fcf6.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:1772
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD5f1ee5807750f29e63fc0d50d37a36ce0
SHA14057704a79a803534a4a1ff25e433f3310201ca3
SHA256bdf8c2af5f3aa174ac1379f242bc5d482f4e34ca10e26fd6ca5d1d2f9656e28b
SHA51204e6ed4d75ba40623259733b1e4c5729f8dba76ad6af2bcc70fdb832997e27da99a49b2a8b6173d45cb7237d9a4b5becf1ada7dbcfa9c6eb09aa3414510cc4ed