Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    65s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04/01/2024, 11:42

General

  • Target

    40c4b11105db1386e30bc870183a6499.exe

  • Size

    354KB

  • MD5

    40c4b11105db1386e30bc870183a6499

  • SHA1

    c91b01612d0a67a9200a6f0780d554a5c1e321fd

  • SHA256

    ec93dd2c8432d31d3be69a3538a20fd344090246dd7289a2db829d9048ce9b5e

  • SHA512

    70fb8f93c6c48cd890990ccb3a8ae85851ba44e94c294cf4aa1760bcdc20daae3e77ad381fbb699e1eb473223643d518f0c47a8955d9f1d700ace5128a575c59

  • SSDEEP

    6144:I2pRrUqddTQZokHv1rQJvnRIAYjY35AiZkpoks5UF1Sf5jGPW2LdMgDbq6nk1/3i:IqUudBkP1UJZIIJpkDrF1SoP/dTBk1/3

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:336
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1272
    • C:\Users\Admin\AppData\Local\Temp\40c4b11105db1386e30bc870183a6499.exe
      "C:\Users\Admin\AppData\Local\Temp\40c4b11105db1386e30bc870183a6499.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Users\Admin\AppData\Local\899c4414\X
        176.53.17.23:80
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2736
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Deletes itself
        PID:1100
  • C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    1⤵
      PID:2716
    • C:\Windows\system32\wbem\wmiprvse.exe
      C:\Windows\system32\wbem\wmiprvse.exe -Embedding
      1⤵
        PID:2680

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\899c4414\@

        Filesize

        2KB

        MD5

        07b881dd4b7648b78671e15221d5f4a3

        SHA1

        d27183d32a5e18b6580af5922c2217dd31280a6b

        SHA256

        d0a323c0edf7a82cb13089ecc3f5e8d30c4506da23df340f28845e841f29e5fc

        SHA512

        99c368f6b7f05f023309dc9a2c5fbdd5ded2e9b87b41e89386a0c5b6c80145f61585605e42602c1c4a23c9847562f55f17ae8f7cdde7a019345b6595b227c403

      • \Users\Admin\AppData\Local\899c4414\X

        Filesize

        41KB

        MD5

        686b479b0ee164cf1744a8be359ebb7d

        SHA1

        8615e8f967276a85110b198d575982a958581a07

        SHA256

        fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b

        SHA512

        7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64

      • \Windows\System32\consrv.dll

        Filesize

        31KB

        MD5

        dafc4a53954b76c5db1d857e955f3805

        SHA1

        a18fa0d38c6656b4398953e77e87eec3b0209ef3

        SHA256

        c6c82dde145a2dd9d70b1b539b17571befb663fc4a9ca834ff2a140cc4ebaa0b

        SHA512

        745e27a4f952e2492dbd12ced396be2c7dc78344ba415ad64b45920f95d7a282e30c7ad2da9266dc195c71e38019809e8183a705f9276c7d178de2f5ef34b633

      • \systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

        Filesize

        2KB

        MD5

        17d0965c79a3343117c6fbee55f41896

        SHA1

        4b52d08815f293e2bab458b494ce8819943677b5

        SHA256

        f5f63222ae7af6e011aa450283bd389943acf33cce14a0536e8d7ce0d8ebc0a6

        SHA512

        412ab8d83aa9ff26638cfa69d3d09a88f6f1e9f5ac2d5465e49ffd15db2592231f2913d4b6d3c1ed22bb72f6325a92a5afb74154a51553d23467825763ec5ea1

      • memory/336-30-0x0000000000730000-0x000000000073C000-memory.dmp

        Filesize

        48KB

      • memory/336-38-0x00000000029B0000-0x00000000029B2000-memory.dmp

        Filesize

        8KB

      • memory/336-28-0x0000000000730000-0x000000000073C000-memory.dmp

        Filesize

        48KB

      • memory/336-29-0x00000000029B0000-0x00000000029B2000-memory.dmp

        Filesize

        8KB

      • memory/1272-54-0x0000000002A50000-0x0000000002A5B000-memory.dmp

        Filesize

        44KB

      • memory/1272-20-0x00000000029B0000-0x00000000029B2000-memory.dmp

        Filesize

        8KB

      • memory/1272-23-0x0000000002A50000-0x0000000002A56000-memory.dmp

        Filesize

        24KB

      • memory/1272-57-0x0000000002A70000-0x0000000002A7B000-memory.dmp

        Filesize

        44KB

      • memory/1272-12-0x0000000002A50000-0x0000000002A56000-memory.dmp

        Filesize

        24KB

      • memory/1272-16-0x0000000002A50000-0x0000000002A56000-memory.dmp

        Filesize

        24KB

      • memory/1272-55-0x0000000002A70000-0x0000000002A7B000-memory.dmp

        Filesize

        44KB

      • memory/1272-50-0x0000000002A50000-0x0000000002A5B000-memory.dmp

        Filesize

        44KB

      • memory/1272-45-0x0000000002A50000-0x0000000002A5B000-memory.dmp

        Filesize

        44KB

      • memory/1272-46-0x00000000029A0000-0x00000000029A8000-memory.dmp

        Filesize

        32KB

      • memory/1272-62-0x0000000002A70000-0x0000000002A7B000-memory.dmp

        Filesize

        44KB

      • memory/2436-19-0x0000000000660000-0x0000000000760000-memory.dmp

        Filesize

        1024KB

      • memory/2436-35-0x0000000000660000-0x0000000000760000-memory.dmp

        Filesize

        1024KB

      • memory/2436-34-0x0000000000370000-0x00000000003A3000-memory.dmp

        Filesize

        204KB

      • memory/2436-32-0x00000000007D0000-0x00000000008D0000-memory.dmp

        Filesize

        1024KB

      • memory/2436-31-0x0000000000400000-0x0000000000466244-memory.dmp

        Filesize

        408KB

      • memory/2436-1-0x0000000000400000-0x0000000000466244-memory.dmp

        Filesize

        408KB

      • memory/2436-17-0x0000000000370000-0x00000000003A3000-memory.dmp

        Filesize

        204KB

      • memory/2436-9-0x0000000000370000-0x00000000003A3000-memory.dmp

        Filesize

        204KB

      • memory/2436-6-0x0000000000370000-0x00000000003A3000-memory.dmp

        Filesize

        204KB

      • memory/2436-58-0x0000000000400000-0x0000000000466244-memory.dmp

        Filesize

        408KB

      • memory/2436-60-0x0000000000370000-0x00000000003A3000-memory.dmp

        Filesize

        204KB

      • memory/2436-61-0x0000000000400000-0x0000000000466244-memory.dmp

        Filesize

        408KB

      • memory/2436-3-0x0000000000370000-0x00000000003A3000-memory.dmp

        Filesize

        204KB

      • memory/2436-2-0x00000000007D0000-0x00000000008D0000-memory.dmp

        Filesize

        1024KB