Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 12:12
Behavioral task
behavioral1
Sample
7235d8195a01b40e76682dc285f8ab21.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7235d8195a01b40e76682dc285f8ab21.exe
Resource
win10v2004-20231215-en
General
-
Target
7235d8195a01b40e76682dc285f8ab21.exe
-
Size
11KB
-
MD5
7235d8195a01b40e76682dc285f8ab21
-
SHA1
b8340dd133116f938f6a38c3ba6cfa5fc4c790d0
-
SHA256
f2090230c2c3ae208cb137ec72bea7536a598a9a20751b68451cb7412b60c1ea
-
SHA512
e3a084aa256b72d3696bfbc9720bb15ef165ed79a543dd168eadb4b38b8b760fe85b7a36ba0b589c712f8d6ad2f1db82a61e2e6046f099d4e7a93dae791dcce6
-
SSDEEP
192:CuxZH2B7O5mv/scm+eTo/+Dkl4usLZRtC45v2CmZ4Vlt3twKeYOTpzs+:CuLWB7ImnE+eTo/g84usLRCobHFdw2O3
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Deletes itself 1 IoCs
pid Process 2712 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2492 comboausk.exe -
Loads dropped DLL 2 IoCs
pid Process 2240 7235d8195a01b40e76682dc285f8ab21.exe 2240 7235d8195a01b40e76682dc285f8ab21.exe -
resource yara_rule behavioral1/memory/2240-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2240-4-0x0000000000030000-0x000000000003F000-memory.dmp upx behavioral1/files/0x000a000000012247-11.dat upx behavioral1/memory/2240-10-0x0000000000030000-0x000000000003F000-memory.dmp upx behavioral1/memory/2492-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2240-20-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\comboaus.dll 7235d8195a01b40e76682dc285f8ab21.exe File created C:\Windows\SysWOW64\comboausk.exe 7235d8195a01b40e76682dc285f8ab21.exe File opened for modification C:\Windows\SysWOW64\comboausk.exe 7235d8195a01b40e76682dc285f8ab21.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2240 7235d8195a01b40e76682dc285f8ab21.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2492 2240 7235d8195a01b40e76682dc285f8ab21.exe 28 PID 2240 wrote to memory of 2492 2240 7235d8195a01b40e76682dc285f8ab21.exe 28 PID 2240 wrote to memory of 2492 2240 7235d8195a01b40e76682dc285f8ab21.exe 28 PID 2240 wrote to memory of 2492 2240 7235d8195a01b40e76682dc285f8ab21.exe 28 PID 2240 wrote to memory of 2712 2240 7235d8195a01b40e76682dc285f8ab21.exe 29 PID 2240 wrote to memory of 2712 2240 7235d8195a01b40e76682dc285f8ab21.exe 29 PID 2240 wrote to memory of 2712 2240 7235d8195a01b40e76682dc285f8ab21.exe 29 PID 2240 wrote to memory of 2712 2240 7235d8195a01b40e76682dc285f8ab21.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7235d8195a01b40e76682dc285f8ab21.exe"C:\Users\Admin\AppData\Local\Temp\7235d8195a01b40e76682dc285f8ab21.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\comboausk.exeC:\Windows\system32\comboausk.exe ˜‰2⤵
- Executes dropped EXE
PID:2492
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\7235d8195a01b40e76682dc285f8ab21.exe.bat2⤵
- Deletes itself
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182B
MD575ad80ba771b9be9077d50d6b746ac02
SHA1999dfa0b83386ed1b39c9fcaa7286c9438804b25
SHA256876727afc4b21ef9a237aba1f9f0f5af00766c20b4e3383436f24f1f0188fc72
SHA512ff6bb8a115726e54d60d5b4b27ee358601ee96f3c2168f19db67e96d71c5fd563d57a2c70c78da79dc9d7d09c1ece645548bc5acafc8e50045dfba9fdc528b8e
-
Filesize
11KB
MD57235d8195a01b40e76682dc285f8ab21
SHA1b8340dd133116f938f6a38c3ba6cfa5fc4c790d0
SHA256f2090230c2c3ae208cb137ec72bea7536a598a9a20751b68451cb7412b60c1ea
SHA512e3a084aa256b72d3696bfbc9720bb15ef165ed79a543dd168eadb4b38b8b760fe85b7a36ba0b589c712f8d6ad2f1db82a61e2e6046f099d4e7a93dae791dcce6