Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 14:17
Static task
static1
Behavioral task
behavioral1
Sample
41151e1d13fe8f835b06c5b6538df69f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
41151e1d13fe8f835b06c5b6538df69f.exe
Resource
win10v2004-20231215-en
General
-
Target
41151e1d13fe8f835b06c5b6538df69f.exe
-
Size
178KB
-
MD5
41151e1d13fe8f835b06c5b6538df69f
-
SHA1
87b504c9840891412e36884bf351fee4b12ab546
-
SHA256
e8782ceb49f1fe55510c907ad7c95601a89e7fd9ba6f0859c5cc9fd436772d8c
-
SHA512
c1d275b11502eeeb99b48b8063e2b8d27898b129bb6dd469d358b1ab396fb69d7a3bcb055eb6a88fc96a95a3c51eeb58ec33cbdc1486390992ce4d2957b2c48d
-
SSDEEP
3072:2wjmK0lZmJAQcD9sBNI9wMsxjhIPYDDlqdLv45q/yXs30rzqQ/vEEfjMvR:2bNWY9SIuMUhIPAqdLvuooGQnFM5
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2872 ctfmon.exe 2412 300186c696818226368e927051ab1f357b60c.exe 340 csrss.exe -
Loads dropped DLL 10 IoCs
pid Process 2936 41151e1d13fe8f835b06c5b6538df69f.exe 2936 41151e1d13fe8f835b06c5b6538df69f.exe 2872 ctfmon.exe 2872 ctfmon.exe 2872 ctfmon.exe 2936 41151e1d13fe8f835b06c5b6538df69f.exe 2936 41151e1d13fe8f835b06c5b6538df69f.exe 2412 300186c696818226368e927051ab1f357b60c.exe 2412 300186c696818226368e927051ab1f357b60c.exe 2412 300186c696818226368e927051ab1f357b60c.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2412 300186c696818226368e927051ab1f357b60c.exe 2412 300186c696818226368e927051ab1f357b60c.exe 2412 300186c696818226368e927051ab1f357b60c.exe 2412 300186c696818226368e927051ab1f357b60c.exe 340 csrss.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2412 300186c696818226368e927051ab1f357b60c.exe Token: SeDebugPrivilege 2412 300186c696818226368e927051ab1f357b60c.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 340 csrss.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2872 2936 41151e1d13fe8f835b06c5b6538df69f.exe 18 PID 2936 wrote to memory of 2872 2936 41151e1d13fe8f835b06c5b6538df69f.exe 18 PID 2936 wrote to memory of 2872 2936 41151e1d13fe8f835b06c5b6538df69f.exe 18 PID 2936 wrote to memory of 2872 2936 41151e1d13fe8f835b06c5b6538df69f.exe 18 PID 2936 wrote to memory of 2872 2936 41151e1d13fe8f835b06c5b6538df69f.exe 18 PID 2936 wrote to memory of 2872 2936 41151e1d13fe8f835b06c5b6538df69f.exe 18 PID 2936 wrote to memory of 2872 2936 41151e1d13fe8f835b06c5b6538df69f.exe 18 PID 2936 wrote to memory of 2412 2936 41151e1d13fe8f835b06c5b6538df69f.exe 29 PID 2936 wrote to memory of 2412 2936 41151e1d13fe8f835b06c5b6538df69f.exe 29 PID 2936 wrote to memory of 2412 2936 41151e1d13fe8f835b06c5b6538df69f.exe 29 PID 2936 wrote to memory of 2412 2936 41151e1d13fe8f835b06c5b6538df69f.exe 29 PID 2936 wrote to memory of 2412 2936 41151e1d13fe8f835b06c5b6538df69f.exe 29 PID 2936 wrote to memory of 2412 2936 41151e1d13fe8f835b06c5b6538df69f.exe 29 PID 2936 wrote to memory of 2412 2936 41151e1d13fe8f835b06c5b6538df69f.exe 29 PID 2412 wrote to memory of 1380 2412 300186c696818226368e927051ab1f357b60c.exe 7 PID 2412 wrote to memory of 340 2412 300186c696818226368e927051ab1f357b60c.exe 27 PID 2412 wrote to memory of 2840 2412 300186c696818226368e927051ab1f357b60c.exe 30 PID 2412 wrote to memory of 2840 2412 300186c696818226368e927051ab1f357b60c.exe 30 PID 2412 wrote to memory of 2840 2412 300186c696818226368e927051ab1f357b60c.exe 30 PID 2412 wrote to memory of 2840 2412 300186c696818226368e927051ab1f357b60c.exe 30 PID 2412 wrote to memory of 2840 2412 300186c696818226368e927051ab1f357b60c.exe 30 PID 2412 wrote to memory of 2840 2412 300186c696818226368e927051ab1f357b60c.exe 30 PID 2412 wrote to memory of 2840 2412 300186c696818226368e927051ab1f357b60c.exe 30 PID 340 wrote to memory of 1456 340 csrss.exe 31 PID 340 wrote to memory of 1456 340 csrss.exe 31 PID 340 wrote to memory of 2844 340 csrss.exe 32 PID 340 wrote to memory of 2844 340 csrss.exe 32 PID 340 wrote to memory of 864 340 csrss.exe 15
Processes
-
C:\Users\Admin\AppData\Local\Temp\41151e1d13fe8f835b06c5b6538df69f.exe"C:\Users\Admin\AppData\Local\Temp\41151e1d13fe8f835b06c5b6538df69f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\nsi7B0.tmp\ctfmon.exe"C:\Users\Admin\AppData\Local\Temp\nsi7B0.tmp\ctfmon.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872
-
-
C:\Users\Admin\AppData\Local\Temp\nsi7B0.tmp\300186c696818226368e927051ab1f357b60c.exe"C:\Users\Admin\AppData\Local\Temp\nsi7B0.tmp\300186c696818226368e927051ab1f357b60c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2840
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:864
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵PID:1456
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:340
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:2844