Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 00:14

General

  • Target

    4787553d83d6cb1d17d817b29c3f0d2e.exe

  • Size

    365KB

  • MD5

    4787553d83d6cb1d17d817b29c3f0d2e

  • SHA1

    d8ab6d46a89385b31780ca78ffc2445c1c8de3d4

  • SHA256

    6042378e770691c0c6c1c80ed5807be567f37a3c8608d3027996aa9fe369dc7d

  • SHA512

    36ff0afabed4cb36a5c481df10449513dd21171b1d680e438961e4f153fc7dc9d74f6b7c858cf84a877d34905e1352deb803f8cfe2839edcb5892d400d1d2c2e

  • SSDEEP

    6144:0bq+bIZrZL+TnqRTMdDVJJ8pnXunpWH3rF2dWVOfis9yMdnWFJ0htBuNhRI:T+IZQrqRAdD+pXunQ7F2djdIJ0ht6k

Malware Config

Signatures

  • Windows security bypass 2 TTPs 10 IoCs
  • Disables taskbar notifications via registry modification
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4787553d83d6cb1d17d817b29c3f0d2e.exe
    "C:\Users\Admin\AppData\Local\Temp\4787553d83d6cb1d17d817b29c3f0d2e.exe"
    1⤵
    • Windows security bypass
    • Loads dropped DLL
    • Windows security modification
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe
      "C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\4787553d83d6cb1d17d817b29c3f0d2e.exe"
      2⤵
      • Windows security bypass
      • Deletes itself
      • Executes dropped EXE
      • Windows security modification
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2060

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe

    Filesize

    37KB

    MD5

    44d4f7f20686ba39077f7a5ab977f3ca

    SHA1

    86d58b04b300c2c3a37b024314a96825d4e63e6a

    SHA256

    8bbfc423aa2780f1b9054d4ea171c71f213989248fdd923882043f0c8977a156

    SHA512

    a1ba5aaebc2caaac6f9c121efcc1f99661706f226c344fcba0de8b3ba9ad7118e56798f64a8815cee05a22e786cdd9633acf3f4c9491537ab5fe11b87db4d6cf

  • C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe

    Filesize

    90KB

    MD5

    75031416d9e0e7fb02a5a26fcfd35438

    SHA1

    e5e2fbcd9fca5d12f885aa06c23a9e5b8a45622d

    SHA256

    7c9c491cf98f08f77301f9d2616fda3564a6658f43ac12d1e0e678035d1c2e20

    SHA512

    4c029ae761cded412ce247f0f338818bcfd91086df860339911c8995db5d428ace53c31099a6e72274452b4818c8cd53511f15fbd2aae40c548ad39770251cde

  • C:\ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe

    Filesize

    1KB

    MD5

    841b69102e698d5eed7911c374d2d37f

    SHA1

    e3e1ae1337892c4e5779d0db4343c7c007fca8f3

    SHA256

    a580b0d9e621e05a2871f2278ee4098b35b68b98f013a2a8f6c57d66155bddca

    SHA512

    2d1e0725201d45337300d7183640e6819e48539a96972d765e6642377c1a871c5c0ea8db05e7bc6b689d9b7cd35fff5c5475b991be26bde5f01b72572ff7e54c

  • \ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe

    Filesize

    71KB

    MD5

    20e6691800b5b8514c7f22275b8986e9

    SHA1

    a63dda7eea8eb106f5dacfed0d0d40ef422dc45f

    SHA256

    f870d481ea8a247c453fa160937f99f66ea2ca8094c112848e9d3e8bb0cd4876

    SHA512

    8b24e357c1007bbf32afb975e5f79ab7a6cc31979785f6a84b61c08eb3dc30bdb28eec354b051ca12c25316db767b548380fe42ff1c218e4a76d35217e5f992c

  • \ProgramData\043A6AEB00014973000C1B69B4EB2331\043A6AEB00014973000C1B69B4EB2331.exe

    Filesize

    52KB

    MD5

    a6582e724c91f74842e46cbfee234d1f

    SHA1

    e2a5bfbe0fc8968c196901defdf162972f871dbd

    SHA256

    db4c0f8a48dbaf2690aceab44108f7cf7a80daab9edbb376578175ccc6d1a5ff

    SHA512

    847ddd4d02253a924f202b495c29e8b9ce2f66c0f2f53356385357cfd63bbc094a4fe84ac1dffe133fb5af2d9b57fcb0bfa5973973e6e09e9ad56a6c9bc59dc6

  • memory/2060-29-0x0000000000620000-0x0000000000621000-memory.dmp

    Filesize

    4KB

  • memory/2060-21-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2060-48-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2060-43-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2060-42-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2060-30-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2060-16-0x0000000000620000-0x0000000000621000-memory.dmp

    Filesize

    4KB

  • memory/2060-18-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2060-22-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2060-23-0x00000000002E0000-0x00000000002E2000-memory.dmp

    Filesize

    8KB

  • memory/2532-6-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2532-4-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2532-27-0x0000000001F10000-0x0000000001F11000-memory.dmp

    Filesize

    4KB

  • memory/2532-3-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2532-28-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2532-0-0x0000000001F10000-0x0000000001F11000-memory.dmp

    Filesize

    4KB

  • memory/2532-39-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2532-7-0x00000000002F0000-0x00000000002F2000-memory.dmp

    Filesize

    8KB

  • memory/2532-5-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB

  • memory/2532-1-0x0000000000410000-0x000000000052D000-memory.dmp

    Filesize

    1.1MB