Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 09:32
Static task
static1
Behavioral task
behavioral1
Sample
0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe
Resource
win10v2004-20231215-en
General
-
Target
0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe
-
Size
196KB
-
MD5
ff8278655cd1407af30c403a7803e644
-
SHA1
c96d6e51eb8520a76e416e24f3508990e00253d2
-
SHA256
0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e
-
SHA512
b4d0dffea25ba62071180c0d5ef9c86de269644485ae85022148792795e8b9b77e6e786cc8995a764ac54c45b14bc454b1729781de0ee5cd53381d269ba54749
-
SSDEEP
6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOl:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXg
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1228 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2440 rwmhost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\rwmhost.exe 0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe File opened for modification C:\Windows\Debug\rwmhost.exe 0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rwmhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rwmhost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2128 0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2128 wrote to memory of 1228 2128 0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe 29 PID 2128 wrote to memory of 1228 2128 0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe 29 PID 2128 wrote to memory of 1228 2128 0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe 29 PID 2128 wrote to memory of 1228 2128 0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe"C:\Users\Admin\AppData\Local\Temp\0d6bbd7d85403f1119a7468a2b612dd2d728884d983309042ba2eece78ae003e.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0D6BBD~1.EXE > nul2⤵
- Deletes itself
PID:1228
-
-
C:\Windows\Debug\rwmhost.exeC:\Windows\Debug\rwmhost.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD5c02120fa1d68610a5fe1f50a09d59820
SHA1e282eb3071c94ff410085f1db2464969a8b3b791
SHA2563763cc7657ef55e2bbed43190b813c0dbe998ac0178f8265b8e746e400edbda2
SHA512cb8911913946c86261e5b5e8c6ecd1e6903728e969d1734c7c2f11c966ebfeddb87ca6486aa957729ba294ebbf68d4c7bc3750c699c9966ad33c1cb2a00d83fe