Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
27/01/2024, 07:13
General
-
Target
7999aaa9f33981c58a73448cc5778c0c.exe
-
Size
232KB
-
MD5
7999aaa9f33981c58a73448cc5778c0c
-
SHA1
cc5ff93b593de57aeea9ec7713f9b61ac57fa28d
-
SHA256
0cf276945bc54e734b7ea57cce18b2dabdc7bb18d0a849ee54f319de5c11ba5c
-
SHA512
bf5e2c5370d149959d61b68caa72b5ac8fc678d97adce15cf41409ffabf4a9cb52233d794fb2ea423dea8b046a9c2c3f0b043b0b6bd0c278bad15b95db94123a
-
SSDEEP
3072:lHMNyf21VHTCyPNHhP/VToqbeAtoH2ts7bLkAV7sp23MANi4q6DT4a:lHM1t5tDoH2tIs
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7999aaa9f33981c58a73448cc5778c0c.exe"C:\Users\Admin\AppData\Local\Temp\7999aaa9f33981c58a73448cc5778c0c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Easy Cafe Client.exe2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD57999aaa9f33981c58a73448cc5778c0c
SHA1cc5ff93b593de57aeea9ec7713f9b61ac57fa28d
SHA2560cf276945bc54e734b7ea57cce18b2dabdc7bb18d0a849ee54f319de5c11ba5c
SHA512bf5e2c5370d149959d61b68caa72b5ac8fc678d97adce15cf41409ffabf4a9cb52233d794fb2ea423dea8b046a9c2c3f0b043b0b6bd0c278bad15b95db94123a
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
640KB