Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 18:38
Static task
static1
Behavioral task
behavioral1
Sample
573449aee41dada8315245de9c17f96d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
573449aee41dada8315245de9c17f96d.exe
Resource
win10v2004-20231215-en
General
-
Target
573449aee41dada8315245de9c17f96d.exe
-
Size
3.1MB
-
MD5
573449aee41dada8315245de9c17f96d
-
SHA1
3f134e9e4df7146c6e572069f5d6623d5dc7d200
-
SHA256
1002b595d5153ea888a23b3d5253105fb8e30d94bf9bfc4544f8094a1d849948
-
SHA512
4f30ba1b60dd7a82eccbe443fe0049e4b360d27ea518f3a0a61a7e2a7a5bd967c58739cb165a16fb0e3e129718b9afae78f3fc0a063a2ec4a874d410ab3947ec
-
SSDEEP
98304:QEmhtXP+pTDCrmHZ9Gy7dWHQJIuULiVzxDXwZjUEDYZT+UVim4e:UaTG6HzfznbCfDAVite
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2900 netsh.exe -
Stops running service(s) 3 TTPs
-
Uses Session Manager for persistence 2 TTPs 3 IoCs
Creates Session Manager registry key to run executable early in system boot.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000 reg.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows32 = "C:\\windows\\system\\win.exe" 573449aee41dada8315245de9c17f96d.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\reg_0001.txt 573449aee41dada8315245de9c17f96d.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\system\win.exe 573449aee41dada8315245de9c17f96d.exe File opened for modification C:\windows\system\win.exe 573449aee41dada8315245de9c17f96d.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2764 sc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2732 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2512 573449aee41dada8315245de9c17f96d.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2732 2512 573449aee41dada8315245de9c17f96d.exe 27 PID 2512 wrote to memory of 2732 2512 573449aee41dada8315245de9c17f96d.exe 27 PID 2512 wrote to memory of 2732 2512 573449aee41dada8315245de9c17f96d.exe 27 PID 2512 wrote to memory of 2732 2512 573449aee41dada8315245de9c17f96d.exe 27 PID 2512 wrote to memory of 2764 2512 573449aee41dada8315245de9c17f96d.exe 28 PID 2512 wrote to memory of 2764 2512 573449aee41dada8315245de9c17f96d.exe 28 PID 2512 wrote to memory of 2764 2512 573449aee41dada8315245de9c17f96d.exe 28 PID 2512 wrote to memory of 2764 2512 573449aee41dada8315245de9c17f96d.exe 28 PID 2512 wrote to memory of 2904 2512 573449aee41dada8315245de9c17f96d.exe 30 PID 2512 wrote to memory of 2904 2512 573449aee41dada8315245de9c17f96d.exe 30 PID 2512 wrote to memory of 2904 2512 573449aee41dada8315245de9c17f96d.exe 30 PID 2512 wrote to memory of 2904 2512 573449aee41dada8315245de9c17f96d.exe 30 PID 2512 wrote to memory of 2944 2512 573449aee41dada8315245de9c17f96d.exe 32 PID 2512 wrote to memory of 2944 2512 573449aee41dada8315245de9c17f96d.exe 32 PID 2512 wrote to memory of 2944 2512 573449aee41dada8315245de9c17f96d.exe 32 PID 2512 wrote to memory of 2944 2512 573449aee41dada8315245de9c17f96d.exe 32 PID 2512 wrote to memory of 3060 2512 573449aee41dada8315245de9c17f96d.exe 33 PID 2512 wrote to memory of 3060 2512 573449aee41dada8315245de9c17f96d.exe 33 PID 2512 wrote to memory of 3060 2512 573449aee41dada8315245de9c17f96d.exe 33 PID 2512 wrote to memory of 3060 2512 573449aee41dada8315245de9c17f96d.exe 33 PID 2512 wrote to memory of 2900 2512 573449aee41dada8315245de9c17f96d.exe 37 PID 2512 wrote to memory of 2900 2512 573449aee41dada8315245de9c17f96d.exe 37 PID 2512 wrote to memory of 2900 2512 573449aee41dada8315245de9c17f96d.exe 37 PID 2512 wrote to memory of 2900 2512 573449aee41dada8315245de9c17f96d.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\573449aee41dada8315245de9c17f96d.exe"C:\Users\Admin\AppData\Local\Temp\573449aee41dada8315245de9c17f96d.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system2⤵
- Creates scheduled task(s)
PID:2732
-
-
C:\Windows\SysWOW64\sc.exesc delete GbpSv2⤵
- Launches sc.exe
PID:2764
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:2904
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:2944
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f2⤵
- Uses Session Manager for persistence
PID:3060
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram C:\windows\system\win.exe RPCCC2⤵
- Modifies Windows Firewall
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1