Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 05:30
Static task
static1
Behavioral task
behavioral1
Sample
42e15a6ef1dc6d2cc85a6b42b6cb8260.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
42e15a6ef1dc6d2cc85a6b42b6cb8260.exe
Resource
win10v2004-20231215-en
General
-
Target
42e15a6ef1dc6d2cc85a6b42b6cb8260.exe
-
Size
133KB
-
MD5
42e15a6ef1dc6d2cc85a6b42b6cb8260
-
SHA1
cd228accdd47da7b6318811de1043705562d2924
-
SHA256
5ec198ff9c73d9a678840540d2f58f67976f80c8801efd4a762c32476508b81e
-
SHA512
3aee5dc0536104c6e02e91038017cc5a66acc706dcdf0f8bf5e8a63a913d429d6a6d4f6b831032dbea63a90d19f8d08da9e5a402512e480a9a9fffee00a39027
-
SSDEEP
3072:KBFbrajR/V9xuVQTVuR/8PWrJkdiqyj5KzctLO:EFHgHxuVQSkPW6diqy1a
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2892 netsh.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dmxkn.exe 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dmxkn.exe 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dmxkn.exe eyirad.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dmxkn.exe eyirad.exe -
Executes dropped EXE 6 IoCs
pid Process 3064 eyirad.exe 2660 eyirad.exe 2716 eyirad.exe 2452 eyirad.exe 1532 eyirad.exe 2908 eyirad.exe -
Loads dropped DLL 6 IoCs
pid Process 2796 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 3064 eyirad.exe 2660 eyirad.exe 2716 eyirad.exe 2452 eyirad.exe 1532 eyirad.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\glwbrudt = "C:\\Users\\Admin\\AppData\\Local\\eyirad.exe" eyirad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\glwbrudt = "C:\\Users\\Admin\\AppData\\Local\\eyirad.exe" eyirad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\glwbrudt = "C:\\Users\\Admin\\AppData\\Local\\eyirad.exe" 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\glwbrudt = "C:\\Users\\Admin\\AppData\\Local\\eyirad.exe" 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2016 set thread context of 2796 2016 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 22 PID 1532 set thread context of 2908 1532 eyirad.exe 15 -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 1972 wrote to memory of 3008 1972 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 25 PID 1972 wrote to memory of 3008 1972 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 25 PID 1972 wrote to memory of 3008 1972 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 25 PID 1972 wrote to memory of 3008 1972 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 25 PID 3008 wrote to memory of 2548 3008 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 14 PID 3008 wrote to memory of 2548 3008 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 14 PID 3008 wrote to memory of 2548 3008 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 14 PID 3008 wrote to memory of 2548 3008 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 14 PID 2548 wrote to memory of 2476 2548 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 24 PID 2548 wrote to memory of 2476 2548 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 24 PID 2548 wrote to memory of 2476 2548 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 24 PID 2548 wrote to memory of 2476 2548 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 24 PID 2476 wrote to memory of 2016 2476 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 23 PID 2476 wrote to memory of 2016 2476 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 23 PID 2476 wrote to memory of 2016 2476 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 23 PID 2476 wrote to memory of 2016 2476 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 23 PID 2016 wrote to memory of 2796 2016 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 22 PID 2016 wrote to memory of 2796 2016 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 22 PID 2016 wrote to memory of 2796 2016 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 22 PID 2016 wrote to memory of 2796 2016 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 22 PID 2016 wrote to memory of 2796 2016 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 22 PID 2016 wrote to memory of 2796 2016 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 22 PID 2016 wrote to memory of 2796 2016 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 22 PID 2016 wrote to memory of 2796 2016 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 22 PID 2796 wrote to memory of 2892 2796 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 21 PID 2796 wrote to memory of 2892 2796 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 21 PID 2796 wrote to memory of 2892 2796 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 21 PID 2796 wrote to memory of 2892 2796 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 21 PID 2796 wrote to memory of 3064 2796 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 20 PID 2796 wrote to memory of 3064 2796 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 20 PID 2796 wrote to memory of 3064 2796 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 20 PID 2796 wrote to memory of 3064 2796 42e15a6ef1dc6d2cc85a6b42b6cb8260.exe 20 PID 3064 wrote to memory of 2660 3064 eyirad.exe 19 PID 3064 wrote to memory of 2660 3064 eyirad.exe 19 PID 3064 wrote to memory of 2660 3064 eyirad.exe 19 PID 3064 wrote to memory of 2660 3064 eyirad.exe 19 PID 2660 wrote to memory of 2716 2660 eyirad.exe 18 PID 2660 wrote to memory of 2716 2660 eyirad.exe 18 PID 2660 wrote to memory of 2716 2660 eyirad.exe 18 PID 2660 wrote to memory of 2716 2660 eyirad.exe 18 PID 2716 wrote to memory of 2452 2716 eyirad.exe 17 PID 2716 wrote to memory of 2452 2716 eyirad.exe 17 PID 2716 wrote to memory of 2452 2716 eyirad.exe 17 PID 2716 wrote to memory of 2452 2716 eyirad.exe 17 PID 2452 wrote to memory of 1532 2452 eyirad.exe 16 PID 2452 wrote to memory of 1532 2452 eyirad.exe 16 PID 2452 wrote to memory of 1532 2452 eyirad.exe 16 PID 2452 wrote to memory of 1532 2452 eyirad.exe 16 PID 1532 wrote to memory of 2908 1532 eyirad.exe 15 PID 1532 wrote to memory of 2908 1532 eyirad.exe 15 PID 1532 wrote to memory of 2908 1532 eyirad.exe 15 PID 1532 wrote to memory of 2908 1532 eyirad.exe 15 PID 1532 wrote to memory of 2908 1532 eyirad.exe 15 PID 1532 wrote to memory of 2908 1532 eyirad.exe 15 PID 1532 wrote to memory of 2908 1532 eyirad.exe 15 PID 1532 wrote to memory of 2908 1532 eyirad.exe 15
Processes
-
C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe31⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe52⤵
- Suspicious use of WriteProcessMemory
PID:2476
-
-
C:\Users\Admin\AppData\Local\eyirad.exeC:\Users\Admin\AppData\Local\eyirad.exe1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
PID:2908
-
C:\Users\Admin\AppData\Local\eyirad.exe71⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1532
-
C:\Users\Admin\AppData\Local\eyirad.exe51⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452
-
C:\Users\Admin\AppData\Local\eyirad.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716
-
C:\Users\Admin\AppData\Local\eyirad.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660
-
C:\Users\Admin\AppData\Local\eyirad.exe"C:\Users\Admin\AppData\Local\eyirad.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram 1.exe 1 ENABLE1⤵
- Modifies Windows Firewall
PID:2892
-
C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exeC:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2796
-
C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe71⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016
-
C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe11⤵
- Suspicious use of WriteProcessMemory
PID:3008
-
C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe"C:\Users\Admin\AppData\Local\Temp\42e15a6ef1dc6d2cc85a6b42b6cb8260.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5054c50f1d5cf38a3d95ca0f28d0c6e2f
SHA1306f88e05fcc45f9d16e3bdc881a72fab555e8e6
SHA25696fde6425963c7ba81dcbd309f6745640d9b345d7195a6452186d01eb1a95ae6
SHA5120dd3ed386601906f1ff5bc109bd5bee217cb20d3876a09961f2c646070eeacfe14ecfd793b8cb38ce30d6b229cb867a6dfe5833a8b53747edcd298f5c5f151dc
-
Filesize
49KB
MD507604f979c5d98de43b9af7976c2b401
SHA169bc9ffafa8ec9e39f53c2417f8431bb1f10398b
SHA2562c4ceb643005305bdd83a9ca7c5bdcd3dfe8f17c1bbd8d7302c5ba8bbe8197e1
SHA5126fb90db669b556edea2d70463631844571dc77ba4510a973c7f82b933c6137a7b04861c86546f1e4060c65529beffdfbdde72ed91caf65bdbb37e1168b2efff9
-
Filesize
49KB
MD5ff29d170565481ff8b9a6b4b6dee40c9
SHA112343012323a68df16ac81ed238e70721f3e073d
SHA256a45918c0037a4f888de1e576ca2fcbdcbe46784cee194e1a21755650adb1cf0e
SHA5125468bd661a23bdd01113d10aaa13abe6f613eefe00a1182c7a1f36e30e5846930c3832fcfc4470a8701b0998c42950de713992fc74ab362ee567633bc68bdc49
-
Filesize
59KB
MD52791622f64eaa4890eaeee2dc2454a96
SHA1c7406c8a2d2d227121fde71791012c0fdbc17468
SHA256a2f3828e455c16dd25a58b4589cc2b9fee0a7b3da7cdf05174c2b5721cc73c61
SHA512e88a7ca4c1a59722f89f511e8c44c20a6abae330d8ae6fdd2b1a2d6dce62c87fb93349a4cc44d31dadae8be05e2b11bad7639618053fa645cb2870540f25d362
-
Filesize
59KB
MD54f91d20fcca16de9e44c1c40cd815693
SHA1ec7abba8f51e7cea230548dafa29e9742dce480e
SHA256a4be69b2892d51a818cae589f7417ea73a371106a7fbc2ec3b088cda5d85df4a
SHA512cd5ef5c04fc5a130bcd210ae6cb6e858050156f1979dbf1c9680fb50e52bc956c0c5e8768d9b4b4017e5a92f40395ebfb88f14cd61213c376346f89790078b93
-
Filesize
58KB
MD522d13be8760c523bc0ee9919f37eca2d
SHA17f8f644ce5f69a95d899ae43841e45873ef25aeb
SHA256f2698d8d80bfa7a29cc94470a6329df0b47cde2b6d0e5291a586258d4dccb30d
SHA512b2d81dc5036236cc2e721be10a9f8eedf5d166e538e2fce93e415fb0cc1e781a146baa630746856f523583ef720aabcc6faaf1fb84c9306bea844d281bc0a95a
-
Filesize
65KB
MD54186dfb099ffc76aab7314319f5624c5
SHA1de95535f73108cb37926d88aa1c24155bdf57659
SHA256e0c775b0ba414248c25660036eabed4c09517c073abe2368609fd3ce22af0e54
SHA512ddac08e38ce2dd0c1d684eeecbe9048b9610128ce006dac84a233274ee38beab255a7cfdc500c3f26d466dae92d51ced86b30944368409349b48ecb51e4f92a3
-
Filesize
9KB
MD5934afce9cd2744037d648e519b781f2d
SHA1b3667a09649b72b27f83841e2fc8884975f3fe29
SHA2564acdab43462512e43666856cb1021fd9bbb1e5ace7b1a24690e6fe49bc23cd81
SHA512f473922cfbf8b64f170fe69f12a7c8f69df49a1e8b1a68e529c6ce8e5efd9e21fd175272df56cacebbb449a534db3d9692c4fdf31b31cc0b4d08dae0061049ab
-
Filesize
67KB
MD508e20d01488e994fcba0ee03cdbf694f
SHA18c8aa6e16ded4db710e8bed304ee431f35fe3509
SHA2563b6938cc262afd867c2a47f80ae24493c937b3aa0fb550c7970f4b10251db2fa
SHA512e247f5dc32b91f619f2d229d80496baab126ff2f6068d7dfb915091652eb64339af1c207cd060cc68e256ef6919e5145a1c221c228033744af84040dcbd29eca
-
Filesize
29KB
MD5b9dbdc26ee3ee0a60d64ab2e8ebfca3f
SHA14c8f255bf442d89738e6b7a0c2ea85b120d33eee
SHA2566022bec173cb093befcdef91d33eb2a86eb4482436c3e989baf2496f6c113c19
SHA5122c4ce4ddddf8724912768408e6a510b1f6bb50ec4793d804532bf1f1397c4b6827e3231550635b7e32cf376cc51dae422704e5bf1e6c71ebac54ef6cf36c343c
-
Filesize
56KB
MD514aa37dcb8bc4de167fa2e683200af8b
SHA1cdcacd37421659913758f1dbcf1b934941028e76
SHA256d1a6f0ffaa8a63efcff69251ddd5f4e3fcabb2ec67a4b3599ec2bf111bd5052c
SHA5128f9ad6647e74892c38587d47b3f31ee6c2e87b321fbdb0303eb3c1202f4192172178b630c59ca7aa636c7fb7ddbe3dd7cdbab77b09e8f53520940ae2c86a1f56
-
Filesize
44KB
MD539a7c3f13527528ecdf88ef11beb5dbf
SHA1de17629b29cd720dcaedbf9d554572c646997ea3
SHA2567f5801476901958a7b68a783e50c7365459f82de2a068a1933a88109c9e60857
SHA512e62de98ff83ea22104446894e82bd6a7553faa4d2f9076b476e144afdb0c7a6b536c5c64358c38b4cb1757968f605eedb2a2c9880735a866a2a29c2eaa50dae5
-
Filesize
44KB
MD5642530cad16602ca0171fb2b2289b940
SHA1212d823ea15e3681d8d64a2c4d2cdd4053d9941a
SHA256d487cc54620ae5810a0a7c24afd4079fd0d6b3a7e62e9d28d3ba4738e853089c
SHA512611eabc729303b594668e541a5069e240ecbc58603ace24114b48f076154684298ebfaab25c9f4a515881f26d79708d953f4ded159d53d940f13382eaa10b45d
-
Filesize
83KB
MD57534714c9cd4d683bf0b0a73865bbd09
SHA13b024be275d0b13b86023cb14e7e22edbc193b54
SHA2560baf6a8701abfc8a614192a1816911eb00a7e1d46fd8cf1b2df1c1b86deb2bc2
SHA51297caec77d27fc064518d8645575c9d9198cdf5eefcd0ec4fc4d742854bbfb3560c53fa41f1954171f68a4296306308384f9dd536466d76c1074b5c3cef9b410b
-
Filesize
80KB
MD529b86bd14c0519f44042b5944af96bad
SHA1f27c6c41ca23e799ec7e56931e71b3a34046157d
SHA2561533f3349c75e36aa14ba47ed9c4c3a2cd9bcf43716da250864309fd5c03aa8c
SHA512d1b832b31025729d268218a6f93844a4da2506121ad811bb4c8e06bc34201f03be9be7fd8f879a90136aa62efbb3ea1a6871863350c96cd40d916cbd3e078478