Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 01:24
Static task
static1
Behavioral task
behavioral1
Sample
66880a24978f13e420776c063053a1e1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
66880a24978f13e420776c063053a1e1.exe
Resource
win10v2004-20231215-en
General
-
Target
66880a24978f13e420776c063053a1e1.exe
-
Size
356KB
-
MD5
66880a24978f13e420776c063053a1e1
-
SHA1
71f3e168a521ba92ae19357509fd18864106fc8d
-
SHA256
1bb9588fd26b7e497492acd74dc8fe42fc58059e8c42d4e463e4152d80d2719b
-
SHA512
eba0d9f3c01a78fca542354ef610567e956f1854280f683b93c639032d0129f16614feff92db57fdca626ff332c0dcc9cc115a416ec229d38ede0dd477d17718
-
SSDEEP
6144:7vbx8nj6JlwPJ+Op9IpF/IUj7H1cAI1Pcq/7FSRUQHE:7uj6JlwB+OQhICL1cA+Pdz9
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2940 2gj4KKjpO7pNf0GL.exe -
Executes dropped EXE 2 IoCs
pid Process 1844 2gj4KKjpO7pNf0GL.exe 2940 2gj4KKjpO7pNf0GL.exe -
Loads dropped DLL 5 IoCs
pid Process 2524 66880a24978f13e420776c063053a1e1.exe 2524 66880a24978f13e420776c063053a1e1.exe 2524 66880a24978f13e420776c063053a1e1.exe 1844 2gj4KKjpO7pNf0GL.exe 2940 2gj4KKjpO7pNf0GL.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ycay6rf5lMQqsW = "C:\\ProgramData\\WK9m2PYDw\\2gj4KKjpO7pNf0GL.exe" 66880a24978f13e420776c063053a1e1.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1188 set thread context of 2524 1188 66880a24978f13e420776c063053a1e1.exe 28 PID 1844 set thread context of 2940 1844 2gj4KKjpO7pNf0GL.exe 30 PID 2940 set thread context of 2732 2940 2gj4KKjpO7pNf0GL.exe 31 -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1188 wrote to memory of 2524 1188 66880a24978f13e420776c063053a1e1.exe 28 PID 1188 wrote to memory of 2524 1188 66880a24978f13e420776c063053a1e1.exe 28 PID 1188 wrote to memory of 2524 1188 66880a24978f13e420776c063053a1e1.exe 28 PID 1188 wrote to memory of 2524 1188 66880a24978f13e420776c063053a1e1.exe 28 PID 1188 wrote to memory of 2524 1188 66880a24978f13e420776c063053a1e1.exe 28 PID 1188 wrote to memory of 2524 1188 66880a24978f13e420776c063053a1e1.exe 28 PID 2524 wrote to memory of 1844 2524 66880a24978f13e420776c063053a1e1.exe 29 PID 2524 wrote to memory of 1844 2524 66880a24978f13e420776c063053a1e1.exe 29 PID 2524 wrote to memory of 1844 2524 66880a24978f13e420776c063053a1e1.exe 29 PID 2524 wrote to memory of 1844 2524 66880a24978f13e420776c063053a1e1.exe 29 PID 1844 wrote to memory of 2940 1844 2gj4KKjpO7pNf0GL.exe 30 PID 1844 wrote to memory of 2940 1844 2gj4KKjpO7pNf0GL.exe 30 PID 1844 wrote to memory of 2940 1844 2gj4KKjpO7pNf0GL.exe 30 PID 1844 wrote to memory of 2940 1844 2gj4KKjpO7pNf0GL.exe 30 PID 1844 wrote to memory of 2940 1844 2gj4KKjpO7pNf0GL.exe 30 PID 1844 wrote to memory of 2940 1844 2gj4KKjpO7pNf0GL.exe 30 PID 2940 wrote to memory of 2732 2940 2gj4KKjpO7pNf0GL.exe 31 PID 2940 wrote to memory of 2732 2940 2gj4KKjpO7pNf0GL.exe 31 PID 2940 wrote to memory of 2732 2940 2gj4KKjpO7pNf0GL.exe 31 PID 2940 wrote to memory of 2732 2940 2gj4KKjpO7pNf0GL.exe 31 PID 2940 wrote to memory of 2732 2940 2gj4KKjpO7pNf0GL.exe 31 PID 2940 wrote to memory of 2732 2940 2gj4KKjpO7pNf0GL.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\66880a24978f13e420776c063053a1e1.exe"C:\Users\Admin\AppData\Local\Temp\66880a24978f13e420776c063053a1e1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\66880a24978f13e420776c063053a1e1.exe"C:\Users\Admin\AppData\Local\Temp\66880a24978f13e420776c063053a1e1.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\ProgramData\WK9m2PYDw\2gj4KKjpO7pNf0GL.exe"C:\ProgramData\WK9m2PYDw\2gj4KKjpO7pNf0GL.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\ProgramData\WK9m2PYDw\2gj4KKjpO7pNf0GL.exe"C:\ProgramData\WK9m2PYDw\2gj4KKjpO7pNf0GL.exe"4⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe"C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe" /i:29405⤵PID:2732
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD56266bf27c22b70e2d21cafe377601b05
SHA197b97c0d5d6878d7dec249934acd77c2598f2a72
SHA25655d7a68c98cb00a95eedaabbacc2504bdd97e1c2732ef8966bcfc1c6cdec6adf
SHA512746807b550a76e9471e48334569d49d1eb4705453ef9cf21f096df9dfdd2182137f172a7d0c5f38d9932c64c4c20c026533c01d134bc12207fd6bbd34341d4c2
-
Filesize
239KB
MD526882f5c40ba24922aaec7d205148b08
SHA1d4de6af07e665fd3b3ac4ebdf42abe238720f63b
SHA2569c081a7e772fdb37c606899d1bbeaf85cd83a6dcd3ce253de87736f5b96ae2a5
SHA51291ad396bb15cae1c34ca7834534408a444a95f9266a459302c7e9b85d6009b4842761131870a0a0513fe26ad4c09f11d1bbb41cc5f66193f21711bbf09c68776
-
Filesize
356KB
MD566880a24978f13e420776c063053a1e1
SHA171f3e168a521ba92ae19357509fd18864106fc8d
SHA2561bb9588fd26b7e497492acd74dc8fe42fc58059e8c42d4e463e4152d80d2719b
SHA512eba0d9f3c01a78fca542354ef610567e956f1854280f683b93c639032d0129f16614feff92db57fdca626ff332c0dcc9cc115a416ec229d38ede0dd477d17718
-
Filesize
67KB
MD58802e9346791d0d181e107b88109276f
SHA1293b7e748cd2542fa806624e61fe2f62cadfa8ad
SHA25685cf74d0758c55c3b6eaba3b2d60eecade4227beceb661e435ef1e0b24f67fce
SHA5123a9782709fb535622e8bb271bad6642dc0ce736dba89a4fae5cdbb0b3c813f75080aa18b913b98644447cfd2860f493871d2f6a0368e3c8d963a76a3059f4415