Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 19:13
Static task
static1
Behavioral task
behavioral1
Sample
754bb367ea73ae3616a5b9e9a6045f03.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
754bb367ea73ae3616a5b9e9a6045f03.exe
Resource
win10v2004-20231215-en
General
-
Target
754bb367ea73ae3616a5b9e9a6045f03.exe
-
Size
304KB
-
MD5
754bb367ea73ae3616a5b9e9a6045f03
-
SHA1
c83e29964f51efd95d199127b0590e9ad048b673
-
SHA256
22e4b7dd981aac439167c00093cb3d4908536d080420df5ef73726cd604733d2
-
SHA512
e923fb4c7f5ac4f13b91225812f85cfaffb0072ab9073fe30497c7b65e6185922bde1bcdbb2bc1b3ecf201e954599d298b440c71f8f4d683147bcb5d0c0f278d
-
SSDEEP
6144:drkW9uEo2S1YnQmCX492DkwNP3qpYF4AqqWb+qR9h+uqkNfoM6YV5TmNa1a3SyPv:drkuu6/eIo4tQW62T+uTwM6YVxm24v
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2072 754bb367ea73ae3616a5b9e9a6045f03.exe 2072 754bb367ea73ae3616a5b9e9a6045f03.exe 2072 754bb367ea73ae3616a5b9e9a6045f03.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 754bb367ea73ae3616a5b9e9a6045f03.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 754bb367ea73ae3616a5b9e9a6045f03.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2072 754bb367ea73ae3616a5b9e9a6045f03.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2708 2072 754bb367ea73ae3616a5b9e9a6045f03.exe 29 PID 2072 wrote to memory of 2708 2072 754bb367ea73ae3616a5b9e9a6045f03.exe 29 PID 2072 wrote to memory of 2708 2072 754bb367ea73ae3616a5b9e9a6045f03.exe 29 PID 2072 wrote to memory of 2708 2072 754bb367ea73ae3616a5b9e9a6045f03.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\754bb367ea73ae3616a5b9e9a6045f03.exe"C:\Users\Admin\AppData\Local\Temp\754bb367ea73ae3616a5b9e9a6045f03.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin13B9.bat"2⤵PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
886B
MD59a0d1397e19eb7d2363d077d030083e8
SHA118e4a059b80c8678f7ac83ce7c841edcc41bb863
SHA2565e6d1113c0c97aa5bb0a41f9b98002dace61ecdf592a53babeb9e4d5f4adc9ea
SHA512b0cce04f9b1a264da6abb3451c3c41da75401c9512fd36fd9097c2ded8fec7572f4ed834ac822f35fe30e737e3cf9aa7303cdf742ac54f7aa984490760a5be16
-
Filesize
50B
MD51dcf1b82bd186b72dbd210c1644a5550
SHA1427ba24707df8c99fc65560e070fb52868f719ed
SHA25677b9b91554108b2214a1b6f16c9a69bb2df70f831b2078b519ec71ac77011f74
SHA5127f7e1ead9878af5bf441b08f7047173585dceeb74e0ec4351833a53478dd75afc0642cd2a6d6bf45431ad29d66d1835a9ecb12f15dd4795b7d4315437e41a3c1
-
Filesize
2KB
MD5067f44cc38b379a13ce194880f497404
SHA1c1d1ced18a533eda9911466dcd7cec9e4369c15b
SHA2568cec271acd158c9505314dd754ff2492f99bcbd13c71dfc24ee4424f454d1714
SHA512cce7dfabd89a83c34b49dea9c2aa80901f6fc6ac221ee650f2f94e7290a1a253e64babc2e58cdd9baed150455a633ca33c3ab9234e1c11eb9d831550d523d4e2
-
Filesize
15KB
MD5e717f6ce3a7429bfa6d7f3cf66737a4b
SHA101f4042589b4ed88c351ffeac256be7a9d884818
SHA2567be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633
SHA51265a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80
-
Filesize
4KB
MD5c3926cef276c0940dadbc8142153cec9
SHA1f8b350d2b7158f5ab147938961439860d77b9cb4
SHA2560ec48e3c1886bc0169a4bc262f012e9b7914e3b440bb0ecc4d8123924abc9b93
SHA5125b9958095b8a7b39b3a2226a5242faec8d2d799d10e1e4ed6dbfb8aaebe51b7496cf4bb5ad588366a296671df3ba46a3f42860abc7f9501b4cc5efd55dd87904
-
Filesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
Filesize
73KB
MD556e4e9e881524397c9f6dca5ca70b1e8
SHA18ad77bad589591171eb94a593c3814a3b742f79c
SHA2562e6e83c80a887c82c890053f491e0cb24074967b5ae7af7c8c4bcae78af2a22b
SHA512130c83dfc0db281bd7999edc6c295f122ab3ba00c69353daad988866680a6994365874eb29122b8473930d2ba0df58bdfb27eb8897a819f79c8b8e31e6597700
-
Filesize
168KB
MD59f8992a651c85604676b2bbf54830547
SHA1bd2a5cd0038899d97d7c652056c948c33c5bc83d
SHA25661fef12b10bb745094ec1392da30c357d508c2befafddd354cad9922feca8ed4
SHA512a6d7692bdbf1a19eb582150d5387faf7d08119f7b111a809c3b55f9de5ee74481b62a1a745f6ed3817ac4c0245ca52e4db8026690ba6a48d3006d47771b60ed7