Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 02:04
Behavioral task
behavioral1
Sample
4d0e910d49f643ea824bc9287b555a33.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
General
-
Target
4d0e910d49f643ea824bc9287b555a33.exe
-
Size
960KB
-
MD5
4d0e910d49f643ea824bc9287b555a33
-
SHA1
2c86e23ca404966246c5162a013424c9f91c7029
-
SHA256
5feebe124f24422f47f619f11b1457f5f77b633c46f501011761606e16edc20d
-
SHA512
9880e55f7d6cbea256022d6aee207e57ffb3663178ebcb7855f498d0605b045ef50c928452fcdaedbb827435f5c4dd51313099d1ccde1fbdc605b20cee9c1b5c
-
SSDEEP
12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1PqLx6Wq4aaE6KwyF5L0YD:1thEVaPqLBthEVaPqLHthEVaPqLTthF
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 3176 svhost.exe -
resource yara_rule behavioral2/memory/3052-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x0006000000023205-3.dat upx behavioral2/memory/3176-5-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x000b000000023115-104.dat upx behavioral2/memory/3052-458-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/3176-2508-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\y: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3052-458-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral2/memory/3176-2508-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 4d0e910d49f643ea824bc9287b555a33.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3052 4d0e910d49f643ea824bc9287b555a33.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3176 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3052 4d0e910d49f643ea824bc9287b555a33.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3052 4d0e910d49f643ea824bc9287b555a33.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3052 4d0e910d49f643ea824bc9287b555a33.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe 3176 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3052 wrote to memory of 3176 3052 4d0e910d49f643ea824bc9287b555a33.exe 91 PID 3052 wrote to memory of 3176 3052 4d0e910d49f643ea824bc9287b555a33.exe 91 PID 3052 wrote to memory of 3176 3052 4d0e910d49f643ea824bc9287b555a33.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d0e910d49f643ea824bc9287b555a33.exe"C:\Users\Admin\AppData\Local\Temp\4d0e910d49f643ea824bc9287b555a33.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
960KB
MD5050f4273280b4770d33c1f0a8482b69f
SHA1aacc3a7b6af2db47cd50e3c5dce65026b596b153
SHA25657da31077d89bc03f0f5a73135c88573cf55da5bd97c37816e59e086c039a360
SHA512b8970181fd2a6de39431778c0cc70fb73c7f9cb00c63df6b5ad6f040d7b3aa19db29ccf797be677e9c651e997ecb2f2f001b9c74c725ed17d284e441a0c20435
-
Filesize
960KB
MD517f028465c94d22b6689ddf2af7dea7c
SHA11f49fb8b454c8dddbf89b360501ed87ac64f3ff4
SHA2569c66c6392b6acc0df50f54243bd9dc160ff6afc6aeb08184dbb1eef5a389739a
SHA512e7b264ce48a7023949fb73f659990257aa9a35e88c1b8b23dbf9cae80682078247a8f74324747ad99ce9daf4b2abfd0f975c38ec4d99b077f7793a16176c6f48