Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 17:04
Behavioral task
behavioral1
Sample
750afb1d76ee322d7cbc90b21d5c6104.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
General
-
Target
750afb1d76ee322d7cbc90b21d5c6104.exe
-
Size
960KB
-
MD5
750afb1d76ee322d7cbc90b21d5c6104
-
SHA1
0f7ba39b303ea7818b656ff89ba7d3cb7e1d0f1a
-
SHA256
bd72911ea9cab04b4553ba99241d8aa5c6196e085e37615ca01dee6c98ca5c80
-
SHA512
c4c649d55ad4785a207996e7b2799ea2aac32121893e24ae4b3a5dd0b264707c4c60969ec314f5a939ae8ce3617fb08d1355439e32b261621d5bed2a9fa9a475
-
SSDEEP
12288:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wq4aaE6KwyF5L0Y2D1PqLx6Wq4aaE6KwyF5L0Y8:1thEVaPqLBthEVaPqLHthEVaPqLTthS
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
Executes dropped EXE 1 IoCs
pid Process 2500 svhost.exe -
resource yara_rule behavioral2/memory/4356-0-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x0007000000023126-3.dat upx behavioral2/memory/2500-5-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/files/0x000a00000002301d-104.dat upx behavioral2/memory/4356-238-0x0000000000400000-0x0000000000523000-memory.dmp upx behavioral2/memory/2500-2489-0x0000000000400000-0x0000000000523000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\e: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\x: svhost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4356-238-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe behavioral2/memory/2500-2489-0x0000000000400000-0x0000000000523000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe 750afb1d76ee322d7cbc90b21d5c6104.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2500 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 2500 svhost.exe 2500 svhost.exe 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 2500 svhost.exe 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 2500 svhost.exe 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 2500 svhost.exe 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 2500 svhost.exe 2500 svhost.exe 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 2500 svhost.exe 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 2500 svhost.exe 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 2500 svhost.exe 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe 2500 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4356 wrote to memory of 2500 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 87 PID 4356 wrote to memory of 2500 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 87 PID 4356 wrote to memory of 2500 4356 750afb1d76ee322d7cbc90b21d5c6104.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\750afb1d76ee322d7cbc90b21d5c6104.exe"C:\Users\Admin\AppData\Local\Temp\750afb1d76ee322d7cbc90b21d5c6104.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
960KB
MD5cf9f5ad87bbf75d40518a689fcbe1596
SHA107b01d926535677ec3f39a5de5a8eed65dc33321
SHA256742b9927a8ee3dd89b2073318b679ba38280078963efa2b9694f38ea0b77e394
SHA512ad121944bb83886a902e5ed2620eeaae087fe7fda405ba04e9163fcec1107e3e3f84a07dfee40679962dd25fedd3e761169960d6c87ad64ed80990660da94f5f
-
Filesize
960KB
MD55c4f35fa0ffd6eb6488c0f10bcfce816
SHA1f572f49b8c2d47ceceec02e73fa86f603b662316
SHA2560d4757a16985fd9c252eb8a6a6cfff2616d5848cbec935ac3976442b83d48da6
SHA512c865ac9eadb70c79cd024a6e7146a0c014649808ea2366dfdf5bcebb8c495a359cdac71ef8e2022decafc52f65b248adaad25414eeeac4c210835547559dd972