Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 09:54
Behavioral task
behavioral1
Sample
7f89b8e7d5b2deb415f66feecda40aa2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7f89b8e7d5b2deb415f66feecda40aa2.exe
Resource
win10v2004-20231222-en
General
-
Target
7f89b8e7d5b2deb415f66feecda40aa2.exe
-
Size
409KB
-
MD5
7f89b8e7d5b2deb415f66feecda40aa2
-
SHA1
9d26551521abf980412215f6596e19823ffe48d0
-
SHA256
66a470eabf3779bdf77f2282611e8993caa5d89f7db757cf1b1a177cdda63e23
-
SHA512
63cea3c3513ff10fa1cb91b4e46ad7276ecb8fad70884110c86360c48cbcdb770f22d9924aa207aaac23d35407d7d194a1fd874a6e9bb904bb0501fa17f81479
-
SSDEEP
12288:YWNXzBLHbnpkB06HWifbdv4UwZq9SL7eSFEsboS:YWNDJbn8BHnpAUwZiSL7ji
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2244 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2868 ukxuexh.exe -
Loads dropped DLL 2 IoCs
pid Process 2244 cmd.exe 2868 ukxuexh.exe -
resource yara_rule behavioral1/memory/1716-0-0x0000000001000000-0x00000000010B5000-memory.dmp upx behavioral1/files/0x000a000000012253-7.dat upx behavioral1/memory/2868-10-0x0000000001000000-0x00000000010B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2740 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2752 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2740 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2244 1716 7f89b8e7d5b2deb415f66feecda40aa2.exe 28 PID 1716 wrote to memory of 2244 1716 7f89b8e7d5b2deb415f66feecda40aa2.exe 28 PID 1716 wrote to memory of 2244 1716 7f89b8e7d5b2deb415f66feecda40aa2.exe 28 PID 1716 wrote to memory of 2244 1716 7f89b8e7d5b2deb415f66feecda40aa2.exe 28 PID 2244 wrote to memory of 2740 2244 cmd.exe 30 PID 2244 wrote to memory of 2740 2244 cmd.exe 30 PID 2244 wrote to memory of 2740 2244 cmd.exe 30 PID 2244 wrote to memory of 2740 2244 cmd.exe 30 PID 2244 wrote to memory of 2752 2244 cmd.exe 32 PID 2244 wrote to memory of 2752 2244 cmd.exe 32 PID 2244 wrote to memory of 2752 2244 cmd.exe 32 PID 2244 wrote to memory of 2752 2244 cmd.exe 32 PID 2244 wrote to memory of 2868 2244 cmd.exe 33 PID 2244 wrote to memory of 2868 2244 cmd.exe 33 PID 2244 wrote to memory of 2868 2244 cmd.exe 33 PID 2244 wrote to memory of 2868 2244 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f89b8e7d5b2deb415f66feecda40aa2.exe"C:\Users\Admin\AppData\Local\Temp\7f89b8e7d5b2deb415f66feecda40aa2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1716 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7f89b8e7d5b2deb415f66feecda40aa2.exe" & start C:\Users\Admin\AppData\Local\ukxuexh.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 17163⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2752
-
-
C:\Users\Admin\AppData\Local\ukxuexh.exeC:\Users\Admin\AppData\Local\ukxuexh.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
409KB
MD57f89b8e7d5b2deb415f66feecda40aa2
SHA19d26551521abf980412215f6596e19823ffe48d0
SHA25666a470eabf3779bdf77f2282611e8993caa5d89f7db757cf1b1a177cdda63e23
SHA51263cea3c3513ff10fa1cb91b4e46ad7276ecb8fad70884110c86360c48cbcdb770f22d9924aa207aaac23d35407d7d194a1fd874a6e9bb904bb0501fa17f81479