Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 15:13
Static task
static1
Behavioral task
behavioral1
Sample
50e75dc2d5ace8a5669e347ed32c10dd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
50e75dc2d5ace8a5669e347ed32c10dd.exe
Resource
win10v2004-20231222-en
General
-
Target
50e75dc2d5ace8a5669e347ed32c10dd.exe
-
Size
384KB
-
MD5
50e75dc2d5ace8a5669e347ed32c10dd
-
SHA1
5e357ca218cf49f8b18c622ed77c59798ca23322
-
SHA256
70b9b35e34c3a4ec1e946378c40e1d876920d638ec919ef2778e6047c1d5ad90
-
SHA512
d0dc948471e976bfaf75be161a8283ee2fd49e2a48a90e87162e3477511631d27e27fd2740d0a5ee6ebb15995c0154e7b1216e3e57d38413f1d07b685bfe9754
-
SSDEEP
6144:G59TOwr3GP/cSHBWOySe1jCrCzvfAL0OT+dgW/CkVgAtAt:G50QWvHBWOyHCrYfAL0OS6+uA+
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2092 eP10400OpDeK10400.exe -
Executes dropped EXE 1 IoCs
pid Process 2092 eP10400OpDeK10400.exe -
Loads dropped DLL 2 IoCs
pid Process 2000 50e75dc2d5ace8a5669e347ed32c10dd.exe 2000 50e75dc2d5ace8a5669e347ed32c10dd.exe -
resource yara_rule behavioral1/memory/2000-6-0x0000000000400000-0x00000000004EE000-memory.dmp upx behavioral1/memory/2000-17-0x0000000000400000-0x00000000004EE000-memory.dmp upx behavioral1/memory/2092-23-0x0000000000400000-0x00000000004EE000-memory.dmp upx behavioral1/memory/2092-27-0x0000000000400000-0x00000000004EE000-memory.dmp upx behavioral1/memory/2092-36-0x0000000000400000-0x00000000004EE000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eP10400OpDeK10400 = "C:\\ProgramData\\eP10400OpDeK10400\\eP10400OpDeK10400.exe" eP10400OpDeK10400.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main eP10400OpDeK10400.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2000 50e75dc2d5ace8a5669e347ed32c10dd.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2000 50e75dc2d5ace8a5669e347ed32c10dd.exe Token: SeDebugPrivilege 2092 eP10400OpDeK10400.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2092 eP10400OpDeK10400.exe 2092 eP10400OpDeK10400.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2092 2000 50e75dc2d5ace8a5669e347ed32c10dd.exe 28 PID 2000 wrote to memory of 2092 2000 50e75dc2d5ace8a5669e347ed32c10dd.exe 28 PID 2000 wrote to memory of 2092 2000 50e75dc2d5ace8a5669e347ed32c10dd.exe 28 PID 2000 wrote to memory of 2092 2000 50e75dc2d5ace8a5669e347ed32c10dd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\50e75dc2d5ace8a5669e347ed32c10dd.exe"C:\Users\Admin\AppData\Local\Temp\50e75dc2d5ace8a5669e347ed32c10dd.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\ProgramData\eP10400OpDeK10400\eP10400OpDeK10400.exe"C:\ProgramData\eP10400OpDeK10400\eP10400OpDeK10400.exe" "C:\Users\Admin\AppData\Local\Temp\50e75dc2d5ace8a5669e347ed32c10dd.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD52f1182848789bd15becf8a3c2429ee64
SHA1ff99b650db92951580c1f2aac6aef3a2ce391599
SHA256149737854a1ba46c8d4edec522d59797669c8d174cf059da868cdf3b634b6e18
SHA5125f003d9eb809f788198ce4c45e507e7d2b0ade80206ac5a59584e486b416e5daef2bfc3861ae8f99b5619d85c4c05c5e6f4cb573110cf8d610e62603a2e03566
-
Filesize
384KB
MD58662d2ab3dfb11be918721843edd1b01
SHA15d3e29f5e6c7f4c493592cea105dd26acd830361
SHA2561061d0818bcc277166602a0defb07f6e8fdb27aa11d8a241ce081cbb52b92f19
SHA5123b97e5aac180338a78ec981803061f875c2645f3d08a0dfb8a6c6b26efc1a4790e05b9121fae8d2fde1de8827430e9aa02e58dc2ea5388cad90e154943efbea7