Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 20:14
Static task
static1
Behavioral task
behavioral1
Sample
54632e7d37d3142474baff846284247d.exe
Resource
win7-20231129-en
General
-
Target
54632e7d37d3142474baff846284247d.exe
-
Size
812KB
-
MD5
54632e7d37d3142474baff846284247d
-
SHA1
dfd39606a2dce9ffe5887f494d2cba0ee3c8bd22
-
SHA256
dbe6359af1e119c871d0811f321e2ee4044eaf6ec65c68623937d096c197fe8c
-
SHA512
0679ef0eb7b973cef0ebb94bc4e8b0eaf2e5a9ef587b4c54fe81dc984d762bda60266ba83da24bbd5cf9f42110f78b7850e3e4a5cdec8c88037734bf5ccd95ee
-
SSDEEP
12288:2Pp+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvXMpJXfXUy/Wj:2Dpjtacljjy4OyJC+Ah+yFQzHm2G
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2680 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2724 54632e7d37d3142474baff846284247d.exe 2724 54632e7d37d3142474baff846284247d.exe 2724 54632e7d37d3142474baff846284247d.exe 2724 54632e7d37d3142474baff846284247d.exe 2724 54632e7d37d3142474baff846284247d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2724 54632e7d37d3142474baff846284247d.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2680 2724 54632e7d37d3142474baff846284247d.exe 34 PID 2724 wrote to memory of 2680 2724 54632e7d37d3142474baff846284247d.exe 34 PID 2724 wrote to memory of 2680 2724 54632e7d37d3142474baff846284247d.exe 34 PID 2724 wrote to memory of 2680 2724 54632e7d37d3142474baff846284247d.exe 34 PID 2724 wrote to memory of 2584 2724 54632e7d37d3142474baff846284247d.exe 32 PID 2724 wrote to memory of 2584 2724 54632e7d37d3142474baff846284247d.exe 32 PID 2724 wrote to memory of 2584 2724 54632e7d37d3142474baff846284247d.exe 32 PID 2724 wrote to memory of 2584 2724 54632e7d37d3142474baff846284247d.exe 32 PID 2724 wrote to memory of 2816 2724 54632e7d37d3142474baff846284247d.exe 31 PID 2724 wrote to memory of 2816 2724 54632e7d37d3142474baff846284247d.exe 31 PID 2724 wrote to memory of 2816 2724 54632e7d37d3142474baff846284247d.exe 31 PID 2724 wrote to memory of 2816 2724 54632e7d37d3142474baff846284247d.exe 31 PID 2724 wrote to memory of 2468 2724 54632e7d37d3142474baff846284247d.exe 30 PID 2724 wrote to memory of 2468 2724 54632e7d37d3142474baff846284247d.exe 30 PID 2724 wrote to memory of 2468 2724 54632e7d37d3142474baff846284247d.exe 30 PID 2724 wrote to memory of 2468 2724 54632e7d37d3142474baff846284247d.exe 30 PID 2724 wrote to memory of 2720 2724 54632e7d37d3142474baff846284247d.exe 29 PID 2724 wrote to memory of 2720 2724 54632e7d37d3142474baff846284247d.exe 29 PID 2724 wrote to memory of 2720 2724 54632e7d37d3142474baff846284247d.exe 29 PID 2724 wrote to memory of 2720 2724 54632e7d37d3142474baff846284247d.exe 29 PID 2724 wrote to memory of 2812 2724 54632e7d37d3142474baff846284247d.exe 28 PID 2724 wrote to memory of 2812 2724 54632e7d37d3142474baff846284247d.exe 28 PID 2724 wrote to memory of 2812 2724 54632e7d37d3142474baff846284247d.exe 28 PID 2724 wrote to memory of 2812 2724 54632e7d37d3142474baff846284247d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\54632e7d37d3142474baff846284247d.exe"C:\Users\Admin\AppData\Local\Temp\54632e7d37d3142474baff846284247d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\54632e7d37d3142474baff846284247d.exe"{path}"2⤵PID:2812
-
-
C:\Users\Admin\AppData\Local\Temp\54632e7d37d3142474baff846284247d.exe"{path}"2⤵PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\54632e7d37d3142474baff846284247d.exe"{path}"2⤵PID:2468
-
-
C:\Users\Admin\AppData\Local\Temp\54632e7d37d3142474baff846284247d.exe"{path}"2⤵PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\54632e7d37d3142474baff846284247d.exe"{path}"2⤵PID:2584
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BOZtQE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp86BD.tmp"2⤵
- Creates scheduled task(s)
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58b023b9beee9ff35973e5572cc6e4cfc
SHA1f3e5758dc53b116e5eca792b3dc3fbf66ce4a2a5
SHA25615a4d0430c66ce152377a8db078563459f49d1ac07e5bd1f0c43231269a0eafa
SHA512ef4bac70cff6b749cd14441961d05690bb86feb214010c89444f9534664597483bb111a1cba2e2ae4ed5ff0ca0c47a7b24c08b8c05f073f50bbfd8303825db5a