Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/02/2024, 23:44
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare-0171808505a112da368c02f92fe0f9f9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
VirusShare-0171808505a112da368c02f92fe0f9f9.exe
Resource
win10v2004-20231215-en
General
-
Target
VirusShare-0171808505a112da368c02f92fe0f9f9.exe
-
Size
1.0MB
-
MD5
0171808505a112da368c02f92fe0f9f9
-
SHA1
cc9fca798284946358112e6034a3ef74bb4ba046
-
SHA256
0f6285f95e98d7b40f80a03d2d90b350bdc35b139a2d90338375aa97bd303d86
-
SHA512
201e5743f0ee6d7e935909c1a1c998e92f7683fccf02127ee2e3e2792ddbe15d33f7796aa6a6b3522b4d694a4e342ebae602b62bab287af0787e594ca3c8a208
-
SSDEEP
24576:BSuFhCwUuqDluBMfEhJX3z5mKhwbLeoMP:FhxqDosEL3F/w+P
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2708 smes.exe 2748 smes.exe 2796 smes.exe 2560 smes.exe -
Loads dropped DLL 13 IoCs
pid Process 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 2400 cmd.exe 2400 cmd.exe 2708 smes.exe 2708 smes.exe 2400 cmd.exe 2400 cmd.exe 2748 smes.exe 2748 smes.exe 2796 smes.exe 2560 smes.exe 2560 smes.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2708 smes.exe Token: SeDebugPrivilege 2748 smes.exe Token: SeDebugPrivilege 2796 smes.exe Token: 33 2796 smes.exe Token: SeIncBasePriorityPrivilege 2796 smes.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2560 smes.exe 2560 smes.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2400 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 28 PID 2236 wrote to memory of 2400 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 28 PID 2236 wrote to memory of 2400 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 28 PID 2236 wrote to memory of 2400 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 28 PID 2236 wrote to memory of 2400 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 28 PID 2236 wrote to memory of 2400 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 28 PID 2236 wrote to memory of 2400 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 28 PID 2236 wrote to memory of 2768 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 30 PID 2236 wrote to memory of 2768 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 30 PID 2236 wrote to memory of 2768 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 30 PID 2236 wrote to memory of 2768 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 30 PID 2236 wrote to memory of 2768 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 30 PID 2236 wrote to memory of 2768 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 30 PID 2236 wrote to memory of 2768 2236 VirusShare-0171808505a112da368c02f92fe0f9f9.exe 30 PID 2400 wrote to memory of 2708 2400 cmd.exe 32 PID 2400 wrote to memory of 2708 2400 cmd.exe 32 PID 2400 wrote to memory of 2708 2400 cmd.exe 32 PID 2400 wrote to memory of 2708 2400 cmd.exe 32 PID 2400 wrote to memory of 2708 2400 cmd.exe 32 PID 2400 wrote to memory of 2708 2400 cmd.exe 32 PID 2400 wrote to memory of 2708 2400 cmd.exe 32 PID 2400 wrote to memory of 2748 2400 cmd.exe 33 PID 2400 wrote to memory of 2748 2400 cmd.exe 33 PID 2400 wrote to memory of 2748 2400 cmd.exe 33 PID 2400 wrote to memory of 2748 2400 cmd.exe 33 PID 2400 wrote to memory of 2748 2400 cmd.exe 33 PID 2400 wrote to memory of 2748 2400 cmd.exe 33 PID 2400 wrote to memory of 2748 2400 cmd.exe 33 PID 2796 wrote to memory of 2560 2796 smes.exe 35 PID 2796 wrote to memory of 2560 2796 smes.exe 35 PID 2796 wrote to memory of 2560 2796 smes.exe 35 PID 2796 wrote to memory of 2560 2796 smes.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare-0171808505a112da368c02f92fe0f9f9.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare-0171808505a112da368c02f92fe0f9f9.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\smes\u.bat"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\ProgramData\smes\smes.exesmes.exe -install3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\ProgramData\smes\smes.exesmes.exe -start3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\temg_tmp.bat"2⤵PID:2768
-
-
C:\ProgramData\smes\smes.exeC:\ProgramData\smes\smes.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\ProgramData\smes\smes.exeC:\ProgramData\smes\smes.exe -run2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
718B
MD50318d2f94f0145e80c51bfbb3aed769d
SHA1ba8ec32df73b8539eeca46f39e29a4e9af371ea1
SHA25658ea7e766662ed6cd9274313db7824261e16246b2b0d232b973d8e76a1291e43
SHA51200312951c03f6f0caf88d7ad0537c7b29c425d4b4ba08975f2d7a1ac222aa15611488b7fd7b31229aada46d4c0df4d68affe8bdbd860f7aadcaa03e39ead312b
-
Filesize
202B
MD582c928ce93e8a95e9d509875ef658d93
SHA162b51b1b583acd51d4da1719cf509aa2095b380d
SHA256f8c6b067df3adc0aea0e047d3ac5f99b50bfbabe666e14c97caab78df05ea931
SHA51250bebfdc9dcbcd45075e219207fab371ebf270e21a39d4b6b3c3618c4939a2ff7ba4c10160a895fece4c664a4701c210c614b3dffbbc9b25ef2a8074ef41181e
-
Filesize
356B
MD594a5a50febe111e141832a7189d0e5d1
SHA10f5ff0a4a088412bec5d1f993ec1d3ced022a7a2
SHA256f50be76d6d0f3871897ff4587f11b6a666579d9f58f9b899485215956e8cb372
SHA512ab6f7baa6baf71036dd0052f7d6e76a1978f6b12294202b5c9c1ac8ff23f80a5c8b0d4a34a73ac75dc3c5e2b78182b022c2e580db0455d52dc749b8000761cea
-
Filesize
546B
MD56910863c811dc2bc90f23e9baa9829be
SHA15588a18a50c5adbb09a0fa2f9c80e69ab6a4ce91
SHA256ef2010e74a4bcb5dedcc7d1fa8fffbd7e78c3521b85ae7584aa319f7e2277ecc
SHA5123e0cd1efbbfa1915eb95799d43e53cfca9fd68f59f53deeed4dcfdf213abc9a882943089cf395e35537348651f99279c78bb0221048a78be8af4aedf2261fd6b
-
Filesize
425KB
MD5bf5dcfd9da0514334d41cbd80d2a9138
SHA1802f9e0b82edca56be08a33b2ba874b34c31f1e3
SHA256f9506cf9a87aa6bfbf07f2124f2785a711b27a70839ebb95bdd4b2cf747fb060
SHA512246796f2e201cde30043eaa2c0ffb4d2b3bea2bae97261a022824c31a42d2b08998b1bdcd436e8392bdd153dd6fadf9ba69361c7316a6bfda5d475678b7aa5cc
-
Filesize
433KB
MD545199dab51eeece95728abfe25e18f35
SHA159ab0fe25aa2adc253adbecba6862e7432df1c39
SHA256a22006861cac6a849346282e2f7729deeb8f68bf29f13c15ae33d20311f77391
SHA512825c6ae1f88cec3d6c469e6a15cad0430845ecc8d436777092f4c5fe8ecd02abbfeb3e2a17b2f4896b9d6e4b2d229a8b83bfdda75a3e025fc32f86610c6eef12
-
Filesize
209KB
MD51fa47f5b173cee5ef9c3ee1bda0c321e
SHA160ee40236f960affb01d569a32e1b05888bb081a
SHA256b21526716068d2a8550780038e2b5ddb843d77890a07ec82ed9ce9dd0be52c64
SHA51201f39376269a75510347fcf66ff2585b25d5e6e10e26b7feefa3af66e712a5f50c62bff6d40abee733e1ce965d17a2e443664838268eb7c7a2e36fc1c024224d
-
Filesize
44B
MD5704efba1aee1454561da552dda430498
SHA1d20fb96683f769eb9cef1b0a068bcba70aeab9c2
SHA25680b08d35bd27636e0774ce35ab57306f76edc6a0f7058cb1f93733cdf88bf94c
SHA5127e0c9ede686238703af4893af8842c05c48ab1681ae273b32d8085cf1a17aae946c0c823a0a418787522a551d684367259ff8203ebca6e4ec69b6ded95231bd0
-
Filesize
132B
MD546033bedbd1ac80c4fe77702500364f9
SHA1253cefd2eafccb32b931657d6fac5e555fbab1a5
SHA2563c4af158afae2cd33210a217106f39d57ac5ee4b632186e1e0d69d15f43af18e
SHA512029d61b53854dfe64811df3479fefee35e07fd72b0a5319ddccdf3ff786cc7b238b6252400de49699b27c16e0f0cdfe667fa02885b82b0dcdffa2aad7616209a
-
Filesize
441KB
MD57851449473178f9782263d51bc5e3bbc
SHA1ad5148ee1bed2348b320c62c025d52fbcbb28799
SHA256c3bc7ec8428f0bb210a0597c9a0cad1be412b7fa46ea006819a3df9ac23118b4
SHA512b01fc37ac84b81df8d7657000295aed7eb50aaf7f13ab2b2be9030c9f83ed1559318c83c78b4a29926d7d30e9eea9538d123ef4a649179be5a5b54ee71ed9b49
-
Filesize
10KB
MD5055f4f9260e07fc83f71877cbb7f4fad
SHA1a245131af1a182de99bd74af9ff1fab17977a72f
SHA2564209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
SHA512a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b