Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

1e567e8014...52.exe

windows7-x64

10

1e567e8014...52.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    01/01/2024, 10:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1e567e801406427827e509bf37646d52.exe

  • Size

    424KB

  • MD5

    1e567e801406427827e509bf37646d52

  • SHA1

    726221e2a319c2e6ce28117519239740d79dc04f

  • SHA256

    6c74e50ceaa637126b99063629235109343c9d26a47b5600b8ab0d89d7718b8e

  • SHA512

    ce2e4d5aa6dbe95a4f7729c5467cb6a639542e057c29aa7a0b28dc932d1076d52519739fe16097e69af195f2871b247aa226b6014c53ca633ea18f64483911ca

  • SSDEEP

    12288:+isrem3UQJ50J8HCpiz71c2E1GvGc62e:+isrDo8iM15Gca

Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 52 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Views/modifies file attributes 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e567e801406427827e509bf37646d52.exe
    "C:\Users\Admin\AppData\Local\Temp\1e567e801406427827e509bf37646d52.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3056
    • C:\ProgramData\IwTQJSaLxi.exe
      "C:\ProgramData\IwTQJSaLxi.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h "C:\Users\Admin\*.* " /s /d
        3⤵
        • Views/modifies file attributes
        PID:2796
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h "F:\*.*" /s /d
        3⤵
        • Views/modifies file attributes
        PID:2884
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h "C:\*.*" /s /d
        3⤵
        • Drops file in Drivers directory
        • Drops desktop.ini file(s)
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Views/modifies file attributes
        PID:2840
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h "C:\ProgramData\Microsoft\Windows\Start Menu\*.* " /s /d
        3⤵
        • Views/modifies file attributes
        PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\IwTQJSaLxi.exe
    Filesize

    45KB

    MD5

    3775c66f3b844cb4369a837b594f33d7

    SHA1

    bba555c5c56ec841fe22597103b5b7f0d2628c79

    SHA256

    efbc3e9974e542d788fb3cff1e1ddfa54635265fe6b057caa7b3d83729e317c6

    SHA512

    d1e1ca1e7e5b26479f57da5d6d5a56180a14cd2ead3c5582da16221e7a6592e3813ebe1f9ae9c9417d2bbe05440de10e37a8a6af4677ded0e9034c7c49b86825

    Download Submit

  • C:\ProgramData\IwTQJSaLxi.exe
    Filesize

    316KB

    MD5

    21bc5799a2e16999b87fc8ffa8d0eb24

    SHA1

    73ac2bfa1eef0415ca39ca0e601095e8b54458b6

    SHA256

    45296d1f4a2bad91c8467014a5ca92bade5a571c19fe47d77e779f864d749c24

    SHA512

    546ef0c9394e1628620ab92fc8991c4d47d6d42846c724f7bde732671aa5956dce57669a92f405dd9d5e64eb46f422a7d4c0ae24659a311aeeecb8c8c65bc40c

    Download Submit

  • C:\ProgramData\IwTQJSaLxi.exe
    Filesize

    129KB

    MD5

    538a4d1f12dd1d9326a2e63f2e0e8cf1

    SHA1

    f22058918a063bbda9561fd249b3b68b65cf4eae

    SHA256

    0cad6dc39008ec49141cffb8f210cba3c164c19bca815d776ea1870d05a11f0b

    SHA512

    de84772d4ed05f230a054d82be9018117c3686c952533a57c1228107f9e6c6dfb0668a4edb5e7dcb0ddff383208109adc78f2faf83ee57013f73c14db409870b

    Download Submit

  • \ProgramData\IwTQJSaLxi.exe
    Filesize

    96KB

    MD5

    96536d747aeb6dfcf676f9f10368fd38

    SHA1

    ffdc57ba337093309de817b00b6811fd8d9e3bb6

    SHA256

    c02bed6c725b85afc0cac72ac054395fbc7309692acbffa0c9f06078fe20029b

    SHA512

    b6130f99f027d40ac31b7a27f622a6ed420dfe04c975111eb857f314b03bc7f795b000c6f44278849ee4dba28ac6256c7136050237fa3ff9618f2eef90275063

    Download Submit

  • \ProgramData\IwTQJSaLxi.exe
    Filesize

    141KB

    MD5

    aeeee05f346e15f1e5ad0185ada7c45e

    SHA1

    c80c9d92f54e7c89f7b2f4fbc805d5cb0c00791c

    SHA256

    baa2fa7b7c6548db447f4311db9506c8c3385218ef9c06858412a9e3e94e4af5

    SHA512

    b855d4fa4fce3313f279c1d78f44378d3bad50b37fc21261a4c2008b53e878efc57cbb6968427d63faeb8651a88f6757c9dea9ac2fc4cdc6f9562b26768cb25b

    Download Submit

  • memory/1820-13-0x0000000000230000-0x000000000028B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/1820-17-0x0000000000230000-0x000000000028B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/1820-20-0x0000000000600000-0x0000000000671000-memory.dmp

    Filesize

    452KB

    Download

  • memory/3056-1-0x0000000000600000-0x0000000000671000-memory.dmp

    Filesize

    452KB

    Download

  • memory/3056-3-0x0000000000600000-0x0000000000671000-memory.dmp

    Filesize

    452KB

    Download

  • memory/3056-0-0x0000000000440000-0x000000000049B000-memory.dmp

    Filesize

    364KB

    Download

  • memory/3056-16-0x0000000000440000-0x000000000049B000-memory.dmp

    Filesize

    364KB

    Download