Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
09/01/2024, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
4d6dbcf7914b3e8feaf0fbf75f08523c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4d6dbcf7914b3e8feaf0fbf75f08523c.exe
Resource
win10v2004-20231215-en
General
-
Target
4d6dbcf7914b3e8feaf0fbf75f08523c.exe
-
Size
155KB
-
MD5
4d6dbcf7914b3e8feaf0fbf75f08523c
-
SHA1
9f52f32594e2d0bf9c34dbd786c9378b6faf0214
-
SHA256
c3c5ace13b00673a4622119daac1bfdd13bdc88d94124ababcd16324637b8834
-
SHA512
358ece12d00902551bd8a41a06fde4e7b77f0c9f0602165e6f3107a90a93b89b5ff2c26818ddcbcb84f15bed8142ef08a59e9cd31e826e2dc0045b8d86519c4d
-
SSDEEP
3072:XXNPIR7cznPmwECfj+qwuK5xGj4uTFY+Vxl:HNPIp5qTIxGDhYIx
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 4d6dbcf7914b3e8feaf0fbf75f08523c.exe -
Executes dropped EXE 1 IoCs
pid Process 2564 dplaysvr.exe -
Loads dropped DLL 3 IoCs
pid Process 2896 4d6dbcf7914b3e8feaf0fbf75f08523c.exe 2896 4d6dbcf7914b3e8feaf0fbf75f08523c.exe 2564 dplaysvr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dplaysvr = "C:\\Users\\Admin\\AppData\\Local\\dplaysvr.exe" 4d6dbcf7914b3e8feaf0fbf75f08523c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\dplaysvr = "C:\\Users\\Admin\\AppData\\Local\\dplaysvr.exe" 4d6dbcf7914b3e8feaf0fbf75f08523c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2564 dplaysvr.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2896 4d6dbcf7914b3e8feaf0fbf75f08523c.exe 2564 dplaysvr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2564 2896 4d6dbcf7914b3e8feaf0fbf75f08523c.exe 29 PID 2896 wrote to memory of 2564 2896 4d6dbcf7914b3e8feaf0fbf75f08523c.exe 29 PID 2896 wrote to memory of 2564 2896 4d6dbcf7914b3e8feaf0fbf75f08523c.exe 29 PID 2896 wrote to memory of 2564 2896 4d6dbcf7914b3e8feaf0fbf75f08523c.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d6dbcf7914b3e8feaf0fbf75f08523c.exe"C:\Users\Admin\AppData\Local\Temp\4d6dbcf7914b3e8feaf0fbf75f08523c.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\dplaysvr.exe"C:\Users\Admin\AppData\Local\dplaysvr.exe" C:\Users\Admin\AppData\Local\Temp\4d6dbcf7914b3e8feaf0fbf75f08523c.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:2564
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵PID:2320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD537517422efa2162da0cbf1ab53ff8dc9
SHA1e5bf2c0e2107e88d494efcc26787cfba29201eae
SHA256f25d5aa5a4d1c548bb6500be889d240c001407c245b0cd2c3db4470179dd5f4e
SHA512d79b334e86eb17617760cf7ed3dafb348faee89ec52c42dd50e8c249b7803225e959e29ef3660fce7ae7cf84739b9d93eb520c774a08e7da73d5e5f54c88d55d
-
Filesize
30KB
MD5025761b21de842fadae111dd1e88fd29
SHA12ea24e07973d276add5ddf4ae5730393c5acf32e
SHA2563e2b06d8bcf4ca4fd03633fb32de64728889542c4fe34695930f68a3a1b39a3c
SHA512bb9fbbb1179ca2b7eea93daecd40b52d8a966049dd35d6d1ddee617f1eed995b44ff888ce33ec72a402de146087be255a17afe0d2052ee2ce6fe2702c99deee2
-
Filesize
884B
MD5edb70e0091a21ac94afe2a048549979c
SHA184121f1eb4ce53110475ead9515170b320291478
SHA256e187da6700f91309e896681a308d52d7ceb0ce4ebf41a1cd7bca191b18f8716a
SHA512aee14421ce7c4e26dea35fe47f54a0b2e05b751bbceb9ddf97c10d2506d5a521559b682092ed7f122eb88539a2a45eebfd04061fee0712c7e186f697603bb733