Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 15:08
Static task
static1
Behavioral task
behavioral1
Sample
56ca43ba032d7b7929cf2e28207be039.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
56ca43ba032d7b7929cf2e28207be039.exe
Resource
win10v2004-20231215-en
General
-
Target
56ca43ba032d7b7929cf2e28207be039.exe
-
Size
27KB
-
MD5
56ca43ba032d7b7929cf2e28207be039
-
SHA1
2fd42dec311104b87d601d406bb4fbd8c158a29f
-
SHA256
d0fff4c29b2105289d2bb121a80c990e3f7d110f89978a8e8254a9c6eba95784
-
SHA512
c62c8ad1d100e963505045c0b1fb95eb2896b90673b346c21d4a3f5d80b066320ee11284a45cf1e6b21158cde9fa35b43fb689f12f3a4957187b0dbaf7912820
-
SSDEEP
768:ENy+CCW5uVi8ZgT2MMWN5xUpGa/9SPji:EN3e58ZgToWN5QSPO
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2436 win32us.exe -
Executes dropped EXE 4 IoCs
pid Process 2436 win32us.exe 2692 win32us.exe 2592 win32us.exe 1712 win32us.exe -
Loads dropped DLL 14 IoCs
pid Process 2276 56ca43ba032d7b7929cf2e28207be039.exe 2276 56ca43ba032d7b7929cf2e28207be039.exe 2436 win32us.exe 2436 win32us.exe 2436 win32us.exe 2436 win32us.exe 2692 win32us.exe 2692 win32us.exe 2692 win32us.exe 2692 win32us.exe 2592 win32us.exe 2592 win32us.exe 2592 win32us.exe 2592 win32us.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\win32us = "c:\\windows\\system32\\win32us.exe /noconnect" win32us.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\win32us = "c:\\windows\\system32\\win32us.exe /noconnect" 56ca43ba032d7b7929cf2e28207be039.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\win32us = "c:\\windows\\system32\\win32us.exe /noconnect" win32us.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\win32us = "c:\\windows\\system32\\win32us.exe /noconnect" win32us.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\win32us.exe 56ca43ba032d7b7929cf2e28207be039.exe File opened for modification \??\c:\windows\SysWOW64\win32us.exe 56ca43ba032d7b7929cf2e28207be039.exe File opened for modification C:\Windows\SysWOW64\win32us.exe 56ca43ba032d7b7929cf2e28207be039.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2436 2276 56ca43ba032d7b7929cf2e28207be039.exe 27 PID 2276 wrote to memory of 2436 2276 56ca43ba032d7b7929cf2e28207be039.exe 27 PID 2276 wrote to memory of 2436 2276 56ca43ba032d7b7929cf2e28207be039.exe 27 PID 2276 wrote to memory of 2436 2276 56ca43ba032d7b7929cf2e28207be039.exe 27 PID 2436 wrote to memory of 2692 2436 win32us.exe 28 PID 2436 wrote to memory of 2692 2436 win32us.exe 28 PID 2436 wrote to memory of 2692 2436 win32us.exe 28 PID 2436 wrote to memory of 2692 2436 win32us.exe 28 PID 2692 wrote to memory of 2592 2692 win32us.exe 29 PID 2692 wrote to memory of 2592 2692 win32us.exe 29 PID 2692 wrote to memory of 2592 2692 win32us.exe 29 PID 2692 wrote to memory of 2592 2692 win32us.exe 29 PID 2592 wrote to memory of 1712 2592 win32us.exe 30 PID 2592 wrote to memory of 1712 2592 win32us.exe 30 PID 2592 wrote to memory of 1712 2592 win32us.exe 30 PID 2592 wrote to memory of 1712 2592 win32us.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\56ca43ba032d7b7929cf2e28207be039.exe"C:\Users\Admin\AppData\Local\Temp\56ca43ba032d7b7929cf2e28207be039.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\SysWOW64\win32us.exe"C:\windows\system32\win32us.exe" -kill c:\users\admin\appdata\local\temp\56ca43ba032d7b7929cf2e28207be039.exe /install2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\windows\SysWOW64\win32us.exe"C:\windows\system32\win32us.exe" -kill c:\windows\syswow64\win32us.exe /install /install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\windows\SysWOW64\win32us.exe"C:\windows\system32\win32us.exe" -kill c:\windows\syswow64\win32us.exe /install /install /install4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\SysWOW64\win32us.exe"C:\windows\system32\win32us.exe" -kill c:\windows\syswow64\win32us.exe /install /install /install /install5⤵
- Executes dropped EXE
PID:1712
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD556ca43ba032d7b7929cf2e28207be039
SHA12fd42dec311104b87d601d406bb4fbd8c158a29f
SHA256d0fff4c29b2105289d2bb121a80c990e3f7d110f89978a8e8254a9c6eba95784
SHA512c62c8ad1d100e963505045c0b1fb95eb2896b90673b346c21d4a3f5d80b066320ee11284a45cf1e6b21158cde9fa35b43fb689f12f3a4957187b0dbaf7912820