Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2024, 09:32

General

  • Target

    0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe

  • Size

    196KB

  • MD5

    ff8278655cd1407af30c403a7803e644

  • SHA1

    c96d6e51eb8520a76e416e24f3508990e00253d2

  • SHA256

    0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e

  • SHA512

    b4d0dffea25ba62071180c0d5ef9c86de269644485ae85022148792795e8b9b77e6e786cc8995a764ac54c45b14bc454b1729781de0ee5cd53381d269ba54749

  • SSDEEP

    6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOl:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXg

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe
    "C:\Users\Admin\AppData\Local\Temp\0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0D6BBD~1.EXE > nul
      2⤵
      • Deletes itself
      PID:1228
  • C:\Windows\Debug\rwmhost.exe
    C:\Windows\Debug\rwmhost.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    PID:2440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\debug\rwmhost.exe

    Filesize

    196KB

    MD5

    c02120fa1d68610a5fe1f50a09d59820

    SHA1

    e282eb3071c94ff410085f1db2464969a8b3b791

    SHA256

    3763cc7657ef55e2bbed43190b813c0dbe998ac0178f8265b8e746e400edbda2

    SHA512

    cb8911913946c86261e5b5e8c6ecd1e6903728e969d1734c7c2f11c966ebfeddb87ca6486aa957729ba294ebbf68d4c7bc3750c699c9966ad33c1cb2a00d83fe