Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
7fe91422506d646492abd6efe94b7c03.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7fe91422506d646492abd6efe94b7c03.exe
Resource
win10v2004-20231222-en
General
-
Target
7fe91422506d646492abd6efe94b7c03.exe
-
Size
124KB
-
MD5
7fe91422506d646492abd6efe94b7c03
-
SHA1
03bb94bb12236807c2e047bbb2b88eaa932019db
-
SHA256
3404751f67c7c42ae140645255125857b1003ba7205a776fa6d814bfdf997888
-
SHA512
d4e979506aecc15f4d20c2b4baf6ad9a489669aa9fa7898b63d3399d0d05d7510b7f529be0259933694085734aad68e8e83ae7d81fb168e22bc9f5e33469350e
-
SSDEEP
3072:p6y9db2LWBHwyG3nrnVta6UQJvOqN5Mu+g1u0bxGNx+l:piLWBH3G3nxta6UQJvOA5v+g1u0bUNx+
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 7fe91422506d646492abd6efe94b7c03.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\scssrr.exe" 7fe91422506d646492abd6efe94b7c03.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4288 set thread context of 4780 4288 7fe91422506d646492abd6efe94b7c03.exe 88 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\scssrr.exe 7fe91422506d646492abd6efe94b7c03.exe File created C:\Windows\scssrr.exe 7fe91422506d646492abd6efe94b7c03.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2280 reg.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4288 7fe91422506d646492abd6efe94b7c03.exe 4780 7fe91422506d646492abd6efe94b7c03.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4288 wrote to memory of 4780 4288 7fe91422506d646492abd6efe94b7c03.exe 88 PID 4288 wrote to memory of 4780 4288 7fe91422506d646492abd6efe94b7c03.exe 88 PID 4288 wrote to memory of 4780 4288 7fe91422506d646492abd6efe94b7c03.exe 88 PID 4288 wrote to memory of 4780 4288 7fe91422506d646492abd6efe94b7c03.exe 88 PID 4288 wrote to memory of 4780 4288 7fe91422506d646492abd6efe94b7c03.exe 88 PID 4288 wrote to memory of 4780 4288 7fe91422506d646492abd6efe94b7c03.exe 88 PID 4288 wrote to memory of 4780 4288 7fe91422506d646492abd6efe94b7c03.exe 88 PID 4288 wrote to memory of 4780 4288 7fe91422506d646492abd6efe94b7c03.exe 88 PID 4780 wrote to memory of 2684 4780 7fe91422506d646492abd6efe94b7c03.exe 89 PID 4780 wrote to memory of 2684 4780 7fe91422506d646492abd6efe94b7c03.exe 89 PID 4780 wrote to memory of 2684 4780 7fe91422506d646492abd6efe94b7c03.exe 89 PID 2684 wrote to memory of 2280 2684 cmd.exe 91 PID 2684 wrote to memory of 2280 2684 cmd.exe 91 PID 2684 wrote to memory of 2280 2684 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fe91422506d646492abd6efe94b7c03.exe"C:\Users\Admin\AppData\Local\Temp\7fe91422506d646492abd6efe94b7c03.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\7fe91422506d646492abd6efe94b7c03.exeC:\Users\Admin\AppData\Local\Temp\7fe91422506d646492abd6efe94b7c03.exe2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- Modifies registry key
PID:2280
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1