Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 16:46
Static task
static1
Behavioral task
behavioral1
Sample
68222440e7fab33d7b5ec1b6e2672962.exe
Resource
win7-20231215-en
9 signatures
150 seconds
General
-
Target
68222440e7fab33d7b5ec1b6e2672962.exe
-
Size
2.6MB
-
MD5
68222440e7fab33d7b5ec1b6e2672962
-
SHA1
9e756880fc27ce0e0aa9f746039ec5fc0ca60294
-
SHA256
9f853c69ec51eef3b38c508c2cdfaad6230c9cac218b6c1e2c1aade3e2aaa684
-
SHA512
8fc00dc22e870a8e2150bd57b3e26d173a425ab1ab665b16548285489622f2a52db7487ce1a9811fc4c0328f673454be0f8a38d72a30e65727afabef04d63388
-
SSDEEP
49152:wvibll7s0eIB4GzdH21N9vGHE5S9H5EsHBTzPfEAuj0/XN+fX+4T38mc:wS00SGzdHAuPmKJzXEAfXcuwU
Score
10/10
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
dns16-microsoft-health.com:80
Attributes
-
communication_password
1fb84c2caca11d084aafca61f7284a70
-
install_dir
Intel
-
install_file
idrvr32.exe
-
tor_process
tor
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\idrvr32 = "C:\\Users\\Admin\\AppData\\Local\\Intel\\idrvr32.exe" 68222440e7fab33d7b5ec1b6e2672962.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1988 set thread context of 1156 1988 68222440e7fab33d7b5ec1b6e2672962.exe 30 -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1988 68222440e7fab33d7b5ec1b6e2672962.exe -
Suspicious behavior: RenamesItself 11 IoCs
pid Process 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1156 68222440e7fab33d7b5ec1b6e2672962.exe Token: SeShutdownPrivilege 1156 68222440e7fab33d7b5ec1b6e2672962.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1988 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe 1156 68222440e7fab33d7b5ec1b6e2672962.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1988 wrote to memory of 1156 1988 68222440e7fab33d7b5ec1b6e2672962.exe 30 PID 1988 wrote to memory of 1156 1988 68222440e7fab33d7b5ec1b6e2672962.exe 30 PID 1988 wrote to memory of 1156 1988 68222440e7fab33d7b5ec1b6e2672962.exe 30 PID 1988 wrote to memory of 1156 1988 68222440e7fab33d7b5ec1b6e2672962.exe 30 PID 1988 wrote to memory of 1156 1988 68222440e7fab33d7b5ec1b6e2672962.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\68222440e7fab33d7b5ec1b6e2672962.exe"C:\Users\Admin\AppData\Local\Temp\68222440e7fab33d7b5ec1b6e2672962.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\68222440e7fab33d7b5ec1b6e2672962.exe"C:\Users\Admin\AppData\Local\Temp\68222440e7fab33d7b5ec1b6e2672962.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1156
-