Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
85s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 05:21
Static task
static1
Behavioral task
behavioral1
Sample
73d6f2ac24b7d56fbc57027cc97b2533.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
73d6f2ac24b7d56fbc57027cc97b2533.exe
Resource
win10v2004-20231215-en
General
-
Target
73d6f2ac24b7d56fbc57027cc97b2533.exe
-
Size
154KB
-
MD5
73d6f2ac24b7d56fbc57027cc97b2533
-
SHA1
22e6000efb3c8105523895cba69046e64c0ac7fb
-
SHA256
7351147e7f1add344cb20f141dfae9e1831f21f1422a0f39a6bed2b68460f973
-
SHA512
b98db9f01bd64e4d2b35d9c4a187ab90d6920be00e503cd97c6caf2d60743201300caf52ea08c6c7ae39cc56fc692a42c379bdb7a81653453712557c2078ed0e
-
SSDEEP
3072:5W74Xt/i0xBebAAcWU7oCtbBCYCIXbbeKxrjIjhIFh4HalmlNXBSpJ:5W7OZi0xB3zb+I2KxPGIFh46lmjcH
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2752 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 1220 Explorer.EXE 464 services.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{6e73f6ee-16d0-0fbd-d3d6-2b2c4f6dcafa}\\n." 73d6f2ac24b7d56fbc57027cc97b2533.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32\ = "\\\\.\\globalroot\\systemroot\\Installer\\{6e73f6ee-16d0-0fbd-d3d6-2b2c4f6dcafa}\\n." 73d6f2ac24b7d56fbc57027cc97b2533.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32 73d6f2ac24b7d56fbc57027cc97b2533.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both" 73d6f2ac24b7d56fbc57027cc97b2533.exe -
Unexpected DNS network traffic destination 9 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 66.85.130.234 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1044 set thread context of 2752 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 28 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Installer\{6e73f6ee-16d0-0fbd-d3d6-2b2c4f6dcafa}\n 73d6f2ac24b7d56fbc57027cc97b2533.exe File created C:\Windows\Installer\{6e73f6ee-16d0-0fbd-d3d6-2b2c4f6dcafa}\@ 73d6f2ac24b7d56fbc57027cc97b2533.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{6e73f6ee-16d0-0fbd-d3d6-2b2c4f6dcafa}\\n." 73d6f2ac24b7d56fbc57027cc97b2533.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32\ = "\\\\.\\globalroot\\systemroot\\Installer\\{6e73f6ee-16d0-0fbd-d3d6-2b2c4f6dcafa}\\n." 73d6f2ac24b7d56fbc57027cc97b2533.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\clsid 73d6f2ac24b7d56fbc57027cc97b2533.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} 73d6f2ac24b7d56fbc57027cc97b2533.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32 73d6f2ac24b7d56fbc57027cc97b2533.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both" 73d6f2ac24b7d56fbc57027cc97b2533.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe Token: SeDebugPrivilege 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe Token: SeDebugPrivilege 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1044 wrote to memory of 1220 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 18 PID 1044 wrote to memory of 1220 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 18 PID 1044 wrote to memory of 464 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 1 PID 1044 wrote to memory of 2752 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 28 PID 1044 wrote to memory of 2752 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 28 PID 1044 wrote to memory of 2752 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 28 PID 1044 wrote to memory of 2752 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 28 PID 1044 wrote to memory of 2752 1044 73d6f2ac24b7d56fbc57027cc97b2533.exe 28
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:464
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\73d6f2ac24b7d56fbc57027cc97b2533.exe"C:\Users\Admin\AppData\Local\Temp\73d6f2ac24b7d56fbc57027cc97b2533.exe"2⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:2752
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD5fab7de9eafea67f88e43003698024c86
SHA124a4ef27c29cdeabed5e0af867e3f568da40d0c9
SHA256073b1f99871dc56a33dcd55af71d53482816bfc9b3ce5c78ee53bed31b428384
SHA512b4a57a8cc564760526d4cce26ce24e80657c064df373c307bb90cf053d01d04bdfe1def41fedfeb7715e53d8481a98c94bc6f3bf33815b4571d898aa08553fcd
-
Filesize
2KB
MD5b63b31be9f064055df336c36a0fcddbb
SHA1ad25cc2133c46abddaa8cd418cbade450445281b
SHA256a716caefb54fc3b8eb73c22d896a541f07a3d2e60451ac9dd360145063acd3f0
SHA51265b57dd8dd35dc7f1002678e03d3623d717ee541ee6654c34bd9ba6b53454d37e5b0b02b5d04b4137d9e3ac3ed58edc872d960f7688d1aacb130c0a9f7b68b12