Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 12:16
Behavioral task
behavioral1
Sample
e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe
Resource
win10v2004-20231215-en
General
-
Target
e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe
-
Size
536KB
-
MD5
bed29bb681d99164fe95fed1a02a7310
-
SHA1
a02e64da076a1769361b4f7c2523ee0e012d4c5f
-
SHA256
e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc
-
SHA512
0284095b13bfe991f28f8cf63c006601c06b7f9257f3c8cbdb88418eb1ddd32259fe6678d4acff74c0cb6f6fa0e09d0b7ef36f2715cd0f2648ce892486ef4180
-
SSDEEP
12288:phf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:pdQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1520-0-0x00000000009F0000-0x0000000000AF2000-memory.dmp upx behavioral1/memory/1520-51-0x00000000009F0000-0x0000000000AF2000-memory.dmp upx behavioral1/memory/1520-381-0x00000000009F0000-0x0000000000AF2000-memory.dmp upx behavioral1/memory/1520-445-0x00000000009F0000-0x0000000000AF2000-memory.dmp upx behavioral1/memory/1520-738-0x00000000009F0000-0x0000000000AF2000-memory.dmp upx behavioral1/memory/1520-752-0x00000000009F0000-0x0000000000AF2000-memory.dmp upx -
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.114.114 Destination IP 223.5.5.5 Destination IP 114.114.114.114 Destination IP 223.5.5.5 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\1a05e0 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1520 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe 1520 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe 1520 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe 1520 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe 1520 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe 1100 Explorer.EXE 1100 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1520 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe Token: SeTcbPrivilege 1520 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe Token: SeDebugPrivilege 1520 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe Token: SeDebugPrivilege 1100 Explorer.EXE Token: SeTcbPrivilege 1100 Explorer.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1100 1520 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe 19 PID 1520 wrote to memory of 1100 1520 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe 19 PID 1520 wrote to memory of 1100 1520 e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe 19
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe"C:\Users\Admin\AppData\Local\Temp\e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ba94c63c83e8033b9e02da3c8140ae0
SHA18c1440e0ceb97e1291633aea40a6487cf3238cc6
SHA25689675bd767ae98e9aab33fe248721a6c384943d4f267b8148785306ef4663eb2
SHA512355f7de88c56233c3e752ea8c3023e600397b51babe16d7bc964c8348ebc6797b651f3fa413a69f15906e2733d66c349bf51dd51c7bc34db16d0828696354dbd