Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
173s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
02/01/2024, 15:47
General
-
Target
1d44e3a2c13c11d8657db2981d3cafa0.exe
-
Size
276KB
-
MD5
1d44e3a2c13c11d8657db2981d3cafa0
-
SHA1
9319d4f39dcc8ff8756c5c72417d00384308b1fb
-
SHA256
9336fb8902065b2e50f365ef2f9e6fa2fa894e3d931ea2da1c187e326cdf2630
-
SHA512
00fee93220a15c4d225cfc33454ea818355021168c63a0b075ee08ab3abcff541caa7a003a8cfa7291bd3a4de9f30c3b6639399812e5fce9f498cfa31c9c9a7a
-
SSDEEP
6144:NI4N1tJsKnwnZ+hlKfQQ2AF52aFzWSyhRf4xyi4Co1W9UeRvXgAT:NbHIfQQ2ArpWJh9ic1iU6ws
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d44e3a2c13c11d8657db2981d3cafa0.exe"C:\Users\Admin\AppData\Local\Temp\1d44e3a2c13c11d8657db2981d3cafa0.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\LP\0A92\AEC6.tmp"C:\Program Files (x86)\LP\0A92\AEC6.tmp"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\1d44e3a2c13c11d8657db2981d3cafa0.exeC:\Users\Admin\AppData\Local\Temp\1d44e3a2c13c11d8657db2981d3cafa0.exe startC:\Users\Admin\AppData\Roaming\21392\E8F0A.exe%C:\Users\Admin\AppData\Roaming\213922⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1d44e3a2c13c11d8657db2981d3cafa0.exeC:\Users\Admin\AppData\Local\Temp\1d44e3a2c13c11d8657db2981d3cafa0.exe startC:\Program Files (x86)\921E8\lvvm.exe%C:\Program Files (x86)\921E82⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5b0ddb668bf2c3bd23a65e4bcfb6c03d4
SHA17d07d6f63e4a9be1b00a6d57ddac5a8f7d70e094
SHA256c871bd1447ef492e8f1247eff4fb659770f3d42e93d879f0539597a2a7ffd8e2
SHA512ede99c39a65740e721bcc3c75dbb2117b0bb1d2f01688c2db0a9b26f2d153c93704f5eb797121c0f4550f528a6b6cbadbf3d46a10071b2bc77987c52a4831259
-
Filesize
897B
MD592a687d70c8a8564e7256f18e5336e91
SHA147816e41490a27a10f30bb0ce220e7f84a6776a2
SHA256d88dab708a8cb23deaab06e2cf44b04dc8be3949c182f62b58aa6a567f1ccf69
SHA5129f92d331b197e400d140e70af30a3002a047aa0d13713eccac6407c148d5f0c1cf0537ff1e66704df890aeb2cd734df66b18ef3aa15d27cc375f870deb363dbb
-
Filesize
1KB
MD539f7e7122ea0155aeecd23dc88647a11
SHA1e3d776fb8443c9748313ce886b9aa3d447fefd9c
SHA256271f8a70ee17f4138f3ca5f439edc434fd3ab96918aeeadaae7c040a4318a02d
SHA51251d6b8cb1b65d8286e25792904df1a7f96cb95e86fd6a2090e05d72adc529012213dc4fcc41d86c87e6a31fd4010fbf7bc7aaba9ef0e8bad0fb8094ccf2ba5b5
-
Filesize
297B
MD58efa4bc2363eff7856612f527b405acf
SHA1d7e9f5e36e96691ee8cc3c2a9d4c9f387690cb0a
SHA2569d35ff6fd8cddadb8adeeeeda40e5ab1b506a8aaea2f48e693a638cc60a5022b
SHA5122bffd9aa9310811125ed509a78c0900941692889134a7e665bd80d08215e82f147f39f059e7eac65ecba28d5c8cb4073b2f6734dd1b13228761af8bf4101a1f7
-
Filesize
1KB
MD55bc2dd65146a25d5bfa2a8033b594fae
SHA1a5fa8aff6a728c1666f8631eab1dfe271a4ee5d2
SHA2567409d109ae936d856e0d10e4f5fa185ced8bda5ad6d8ee23698479f26deaa2ff
SHA512d504ad235055919757f9bf3bececc54a66899c6982e6cce6f86a8bfea1008d4ba10094e202b1ca0338dfbfdf749d1bec6b86356ceaff86cab5f1aa9b1f24f370
-
Filesize
597B
MD57e166bf83b3f5251d70a34d855a814f2
SHA1c11e2e51ae43e4d775724dde8999db42824f4985
SHA256da52c6a54dbd66d190ecddcfb649e622abddf9797fdf5f2287b8b2768119a07b
SHA5129d6d459118d0dbf00f57b96f16f06120108c09a3fb1fcaed8d7eec3c800d55619470b27bd71a0f19ae633a5b185cc89286fae0fd008fbfe57d6f835cc15b18fe
-
Filesize
424KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
424KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
1024KB
-
Filesize
424KB
-
Filesize
1024KB
-
Filesize
112KB
-
Filesize
112KB