Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
901d946782b7cdcca330975a6729b6ca.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
901d946782b7cdcca330975a6729b6ca.exe
Resource
win10v2004-20231222-en
General
-
Target
901d946782b7cdcca330975a6729b6ca.exe
-
Size
325KB
-
MD5
901d946782b7cdcca330975a6729b6ca
-
SHA1
1316a5bfce6e0fe11ca479cf15313d3ffdd8230e
-
SHA256
11b160985512a52e0370df2e033ee365624938201c0a0c9ec43b18c1feb58c2e
-
SHA512
d81aa5b1696fd5988932571ba78bc79d0f5a526f680ae5501ff876141c9309d5123f2abfcb91346635bf685c4c9848c45174141ce702b11b0443ee3b6d8f0b90
-
SSDEEP
6144:Er1Bh9uEo2S1YnQmCX492DkwNP3qpYFDcYgQUskKWeFCEQOiCYOqmO5oe:Er1B3u6/eIo4ArVUBQCCYOqmO5oe
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 952 901d946782b7cdcca330975a6729b6ca.exe 952 901d946782b7cdcca330975a6729b6ca.exe 952 901d946782b7cdcca330975a6729b6ca.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 901d946782b7cdcca330975a6729b6ca.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 901d946782b7cdcca330975a6729b6ca.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 952 901d946782b7cdcca330975a6729b6ca.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 952 wrote to memory of 3028 952 901d946782b7cdcca330975a6729b6ca.exe 29 PID 952 wrote to memory of 3028 952 901d946782b7cdcca330975a6729b6ca.exe 29 PID 952 wrote to memory of 3028 952 901d946782b7cdcca330975a6729b6ca.exe 29 PID 952 wrote to memory of 3028 952 901d946782b7cdcca330975a6729b6ca.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\901d946782b7cdcca330975a6729b6ca.exe"C:\Users\Admin\AppData\Local\Temp\901d946782b7cdcca330975a6729b6ca.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin9F8B.bat"2⤵PID:3028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
814B
MD5bd5e1676bd73896be4774e1f5b1f3e28
SHA1fa2fc102b6b4f56317e4af04c0373ffa369498fa
SHA2564f38c3e2ff80b27b939625bb197d9972dce1ed130179349f6c213c6520461086
SHA512c9e1d8a0e37f869b2d07b02152fdce80a9a15a4c4ce67ec50c494f0426e33f3f5a4af45a5e3efd297870bf18bee12f1ad0c68900a9fe46235f9c9f565d3f8b78
-
Filesize
59KB
MD505540c9920d602c69ff2781ea01eac29
SHA1c43ecaa5c12bc9541115482f8a164ada8fdeb29a
SHA2561aeb2c74ee76442b50816d039dec3ca7f231e5a6a762ff38fb79a3b0ce66e285
SHA5120d995e9481767cd607e073e8665169600d44732678b1573fa880dc8123ed960593a3f588032a933fceef2b834d6a575419443fd5f5d5c2b44d159a02d15cbdff
-
Filesize
155KB
MD57b69064f9d8ed16762a75ee0d5a256cd
SHA1cfbc959d936c81641ba7d8b220a3c42be26633e2
SHA256d7e3abcc7181b60ab143138d97b54258693418ca0848db9621045dd7c7c8f988
SHA5124b859da41e01bbef00292f6088b9948bd30a8520b0b3ae023e0580f07f75f5cd2875c599e18d02937114bdc5ac2bbe60f497adcf6df0619b55aec083635a454a
-
Filesize
50B
MD5e8085be36abd023c2ae7731c3f113d85
SHA1d07bb13f261ac98b825a9f1f4de88d0d38c66df9
SHA25694f5b7b53363318c555575e42974cb8850ef7552b0fff243f1fed2bd58fb68e0
SHA51257f2ceae004ac94f4caf2c053f6c9e4d3621271cda2529eef7d369d3ea8c79d91ee1a70631da22ce5adbafde74adf585b50437ad86a3de4f90832c6e099b1799
-
Filesize
2KB
MD5cb45f741900f51ed947f0c8061884c9f
SHA13c63ff4c2039094b8e86ae28d17968563061f62f
SHA2566f1bd3c9e1ad5ed8b04a016ab26252627c47e527a75925080828db051387f3d5
SHA512d42b62f1ad800968e19dcdd00658cd77c6106e740456b193d08141af974cf8e6f59c9551489922e160ae23a84e39d2132150fee8cf3a663d0db35516af957000
-
Filesize
15KB
MD5e717f6ce3a7429bfa6d7f3cf66737a4b
SHA101f4042589b4ed88c351ffeac256be7a9d884818
SHA2567be720a73ba8b084702c89f64a9b295fad92545d6ba781072cc056823f9a7633
SHA51265a9a27430811aa01b55cf365f8b7b9f03e70d32ec60e0706242bc568242bcd493999dc1b02d92bf0d01c0095c8c38d30f282a998cafb80e60ad07e0d875ce80
-
Filesize
14KB
MD51623bb0c615eaeed406a3253a606e71c
SHA1e86516e730bdd2a6d0423211f236f4ae9dd4282e
SHA25667664b6561b8bf32091bca59db37a8c8099da01236accfa85f1367bdcb5f0904
SHA5122d854d2732d9562acfe01350fbeb0b78339d01630f114f8c5f95f7542fff2af93393b5c4f977d9602d78dbea23bf41f2f1a9b0252e51a66971facf208803ec5d
-
Filesize
167KB
MD5491646f23ccbd43f0bfe69e5d5bfe33e
SHA1351ce0bb9306c91c11c1c795e6bd336bb5c4e09a
SHA256b5a086b1341b9ed1adee6f2c98a77660eb076e09c1e4d5d4f51cba3e22409ba7
SHA51247a828e5a4cb0566baeb06db27f8ff393612b1c63dd1e401b383ede5fd1b62510f52bfb4e66e6da6d5f5eb7121a016e0a364f6166b3ec13dffd483c650ccfb12
-
Filesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
Filesize
91KB
MD5736682c6d96bb1edc84e77041faae33d
SHA1f8f6e20cd2aa23010b85ea289c3bc3cbdbc9ae26
SHA25654346f2e36bdb512ef4f7d702f18e59a746f0b936786bc76a30e87de0a061f17
SHA512fe24353f0f4acafbde7d8cec7a5078668f5e6cd0b06c3e0c96cb3fed0beb3c8af2becb1d97fcbb369ac38193827c8d8a440694c79b5da3180224377e38f53777
-
Filesize
180KB
MD5a475792794328d8a503568cbe38e8531
SHA147e5c4857f272898ed515e939f92cb9243b2ce2e
SHA2562cd6c67a711059c2245615d80ee0e7d44a003b66d5577513b1dfb1bd7f1e7312
SHA5123ea14ace569233dd69e730b4dfae4f1292d2e950aa26aceeae78715d0831ff6919d1bbf7c70ec256dd8a5db7f2d09ea4f29a564c125b54fdf8c7de2c78631184