Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 12:57
Behavioral task
behavioral1
Sample
53947e11087d5ea12f61b14ff4ecf26d.exe
Resource
win7-20231215-en
windows7-x64
General
-
Target
53947e11087d5ea12f61b14ff4ecf26d.exe
-
Size
8.7MB
-
MD5
53947e11087d5ea12f61b14ff4ecf26d
-
SHA1
f31d04d2ea5fc27472e5cc1a4337c07fe503787e
-
SHA256
cc707470bc011b580d82648799497028f2422a8d18e608619b6fc587e38b38b7
-
SHA512
2d2411169463e217d1b10c4092b98b77e8981d925abfa9fb329c4030ad19136797043264d8b6c0ce5538c88239e601502b684652b7c53471a7a3be970922b3c3
-
SSDEEP
98304:dE35EnE35ETE35E+E35EeE35EqE35EsE35EWE35EKE35EfE35EFE35E1E35EZE3y:v
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 1488 svhost.exe -
resource yara_rule behavioral2/memory/4920-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x001700000001e2b4-3.dat upx behavioral2/files/0x001700000001e2b4-4.dat upx behavioral2/memory/1488-5-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x0006000000023132-85.dat upx behavioral2/memory/4920-100-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/1488-2252-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\b: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4920-100-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral2/memory/1488-2252-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 53947e11087d5ea12f61b14ff4ecf26d.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1488 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 1488 svhost.exe 1488 svhost.exe 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 1488 svhost.exe 1488 svhost.exe 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 1488 svhost.exe 1488 svhost.exe 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 1488 svhost.exe 1488 svhost.exe 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe 1488 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4920 wrote to memory of 1488 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 90 PID 4920 wrote to memory of 1488 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 90 PID 4920 wrote to memory of 1488 4920 53947e11087d5ea12f61b14ff4ecf26d.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\53947e11087d5ea12f61b14ff4ecf26d.exe"C:\Users\Admin\AppData\Local\Temp\53947e11087d5ea12f61b14ff4ecf26d.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
1.4MB
MD5b4814e9dee92d1fdb862507877a9eab8
SHA11a93b464e9a064ecdbc1747ce4c8a70a20c0b1f7
SHA256713d50b56adcf7cc555304f40c2130c74251040fa669695092be0ceed2d749e5
SHA5123a584885b25f19589dd496f3a15c9e5138e236b88cc6ca9992bbafa1a4fc2bd9ea04d1b1e3fa82f987ff749c31df5a9280a0260d32b0a6a6e786eb30ae8152e8
-
Filesize
3.2MB
MD574a8a6cdedc826196ec91a9fc9c0494e
SHA1397573ae00d1ab39bd654fcbf10992975928b8bc
SHA256ece7bf501be65b15caa3a9b4b5accd054c69a8dbf0be74350105bb8252953264
SHA5126ff68e0e5c96acf8d514141910824b411d21af026147fe20dd9b59f181bb46fc8d160e8f3999d6899f83be8fac6e7c13a8dcf75f6b2f0b42c2c78a315e6d5291
-
Filesize
8.7MB
MD567047e2df074e8bdc7135261dc098e73
SHA124d5c5163d4117e2bb144740016f87e160b06629
SHA2566da3493b477129924ac4455882b886b1cf2cc417732514aeed07868989a75e19
SHA512e5fa3a39d3a085ef0ac13dfd051f3203dd649a16a5774935056da6b233697248276a8345574a7c389b45a153ca2f433c58d4a51e3c79bb94b0ff05b87f34dcd6