Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 14:50
Behavioral task
behavioral1
Sample
4bb97f5ee1796e08cb8629b6c80ae993.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4bb97f5ee1796e08cb8629b6c80ae993.exe
Resource
win10v2004-20231222-en
General
-
Target
4bb97f5ee1796e08cb8629b6c80ae993.exe
-
Size
10KB
-
MD5
4bb97f5ee1796e08cb8629b6c80ae993
-
SHA1
1e91821c5ad818e478e72ff0941f5ebed14be0f8
-
SHA256
f5b476806e14d4194b343ff21df31ac1bb9b0aa07179911412dfee95123da72f
-
SHA512
b10d93162bf94a695120243246b6a5b1331bdd1913e1e461179a567dcf8b2efe5ff9066b41d575a89caab3820ed2b4c66088fb7876c62a8102ac741d51978973
-
SSDEEP
192:Ry6qv+F7pQtH5dWVJLD9popPzvKx1jRN6TDzi/6DGLdtYecLbf+OHTTFZ:ITg7pQtHDYLD0p2n+DO/I6YVbjzr
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Deletes itself 1 IoCs
pid Process 2392 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1760 comboausk.exe -
Loads dropped DLL 2 IoCs
pid Process 1716 4bb97f5ee1796e08cb8629b6c80ae993.exe 1716 4bb97f5ee1796e08cb8629b6c80ae993.exe -
resource yara_rule behavioral1/memory/1716-1-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1716-4-0x0000000000030000-0x000000000003E000-memory.dmp upx behavioral1/memory/1760-12-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/files/0x000c000000013a83-9.dat upx behavioral1/files/0x000c000000013a83-3.dat upx behavioral1/memory/1716-20-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\comboaus.dll 4bb97f5ee1796e08cb8629b6c80ae993.exe File created C:\Windows\SysWOW64\comboausk.exe 4bb97f5ee1796e08cb8629b6c80ae993.exe File opened for modification C:\Windows\SysWOW64\comboausk.exe 4bb97f5ee1796e08cb8629b6c80ae993.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1716 4bb97f5ee1796e08cb8629b6c80ae993.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1760 1716 4bb97f5ee1796e08cb8629b6c80ae993.exe 28 PID 1716 wrote to memory of 1760 1716 4bb97f5ee1796e08cb8629b6c80ae993.exe 28 PID 1716 wrote to memory of 1760 1716 4bb97f5ee1796e08cb8629b6c80ae993.exe 28 PID 1716 wrote to memory of 1760 1716 4bb97f5ee1796e08cb8629b6c80ae993.exe 28 PID 1716 wrote to memory of 2392 1716 4bb97f5ee1796e08cb8629b6c80ae993.exe 30 PID 1716 wrote to memory of 2392 1716 4bb97f5ee1796e08cb8629b6c80ae993.exe 30 PID 1716 wrote to memory of 2392 1716 4bb97f5ee1796e08cb8629b6c80ae993.exe 30 PID 1716 wrote to memory of 2392 1716 4bb97f5ee1796e08cb8629b6c80ae993.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bb97f5ee1796e08cb8629b6c80ae993.exe"C:\Users\Admin\AppData\Local\Temp\4bb97f5ee1796e08cb8629b6c80ae993.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\comboausk.exeC:\Windows\system32\comboausk.exe ˜‰2⤵
- Executes dropped EXE
PID:1760
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\4bb97f5ee1796e08cb8629b6c80ae993.exe.bat2⤵
- Deletes itself
PID:2392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD54bb97f5ee1796e08cb8629b6c80ae993
SHA11e91821c5ad818e478e72ff0941f5ebed14be0f8
SHA256f5b476806e14d4194b343ff21df31ac1bb9b0aa07179911412dfee95123da72f
SHA512b10d93162bf94a695120243246b6a5b1331bdd1913e1e461179a567dcf8b2efe5ff9066b41d575a89caab3820ed2b4c66088fb7876c62a8102ac741d51978973