Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_911e66524f9a5cd74310756c975ce7cf.exe
Resource
win7-20231215-en
General
-
Target
VirusShare_911e66524f9a5cd74310756c975ce7cf.exe
-
Size
163KB
-
MD5
911e66524f9a5cd74310756c975ce7cf
-
SHA1
560e3441ba41ba22652d8200ce57f17a9e1ec5c4
-
SHA256
9460876404af1e8aed0eaec4cb29b37631db3c9038d5dd2e6e2fdb3e60a8d0e9
-
SHA512
a92aff4f1095b67610f854e3f8be6fe11679ae0e38a8c0008d2fe493a05f1a613efb418bd8c42e36faf9498d8ecd15dc2f8424790ad5407c44fc184c996efbb8
-
SSDEEP
3072:KswLeUpdrYpctTXSERLK3pgotbLmMGWGLxsYrVd3ZephYrWttlUDzP:zwLjdMCtfRu5/tbLQrXpahHtjk
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Debug\mhost.exe = "C:\\Windows\\Debug\\mhost.exe:*:Enabled:KL" mhost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List VirusShare_911e66524f9a5cd74310756c975ce7cf.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\VirusShare_911e66524f9a5cd74310756c975ce7cf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VirusShare_911e66524f9a5cd74310756c975ce7cf.exe:*:Enabled:KL" VirusShare_911e66524f9a5cd74310756c975ce7cf.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List mhost.exe -
Detects Windows executables referencing non-Windows User-Agents 16 IoCs
resource yara_rule behavioral1/memory/2632-8-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-10-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-12-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-11-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-13-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-18-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-16-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-20-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-23-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-25-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-30-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-31-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2632-41-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/1780-63-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/1780-64-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/1780-67-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 16 IoCs
resource yara_rule behavioral1/memory/2632-8-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-10-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-12-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-11-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-13-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-18-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-16-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-20-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-23-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-25-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-30-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-31-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2632-41-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1780-63-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1780-64-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/1780-67-0x0000000000400000-0x0000000000528000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 2 IoCs
pid Process 2208 mhost.exe 1780 mhost.exe -
Loads dropped DLL 2 IoCs
pid Process 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2824 set thread context of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2208 set thread context of 1780 2208 mhost.exe 33 -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Debug\result.dark VirusShare_911e66524f9a5cd74310756c975ce7cf.exe File created C:\Windows\Debug\bc mhost.exe File opened for modification C:\Windows\Debug\bc mhost.exe File created C:\Windows\Debug\bc VirusShare_911e66524f9a5cd74310756c975ce7cf.exe File opened for modification C:\Windows\Debug\bc VirusShare_911e66524f9a5cd74310756c975ce7cf.exe File created C:\Windows\Debug\mhost.exe VirusShare_911e66524f9a5cd74310756c975ce7cf.exe File opened for modification C:\Windows\Debug\mhost.exe VirusShare_911e66524f9a5cd74310756c975ce7cf.exe File created C:\Windows\Debug\result.dark VirusShare_911e66524f9a5cd74310756c975ce7cf.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2936 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2824 wrote to memory of 2632 2824 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 29 PID 2632 wrote to memory of 2936 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 30 PID 2632 wrote to memory of 2936 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 30 PID 2632 wrote to memory of 2936 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 30 PID 2632 wrote to memory of 2936 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 30 PID 2632 wrote to memory of 2208 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 32 PID 2632 wrote to memory of 2208 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 32 PID 2632 wrote to memory of 2208 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 32 PID 2632 wrote to memory of 2208 2632 VirusShare_911e66524f9a5cd74310756c975ce7cf.exe 32 PID 2208 wrote to memory of 1780 2208 mhost.exe 33 PID 2208 wrote to memory of 1780 2208 mhost.exe 33 PID 2208 wrote to memory of 1780 2208 mhost.exe 33 PID 2208 wrote to memory of 1780 2208 mhost.exe 33 PID 2208 wrote to memory of 1780 2208 mhost.exe 33 PID 2208 wrote to memory of 1780 2208 mhost.exe 33 PID 2208 wrote to memory of 1780 2208 mhost.exe 33 PID 2208 wrote to memory of 1780 2208 mhost.exe 33 PID 2208 wrote to memory of 1780 2208 mhost.exe 33 PID 2208 wrote to memory of 1780 2208 mhost.exe 33 PID 2208 wrote to memory of 1780 2208 mhost.exe 33 PID 2208 wrote to memory of 1780 2208 mhost.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_911e66524f9a5cd74310756c975ce7cf.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_911e66524f9a5cd74310756c975ce7cf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\VirusShare_911e66524f9a5cd74310756c975ce7cf.exeC:\Users\Admin\AppData\Local\Temp\VirusShare_911e66524f9a5cd74310756c975ce7cf.exe2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\sc.exesc delete 2925733⤵
- Launches sc.exe
PID:2936
-
-
C:\Windows\Debug\mhost.exe"C:\Windows\Debug\mhost.exe" /start3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\Debug\mhost.exeC:\Windows\Debug\mhost.exe4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Drops file in Windows directory
PID:1780
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
163KB
MD5911e66524f9a5cd74310756c975ce7cf
SHA1560e3441ba41ba22652d8200ce57f17a9e1ec5c4
SHA2569460876404af1e8aed0eaec4cb29b37631db3c9038d5dd2e6e2fdb3e60a8d0e9
SHA512a92aff4f1095b67610f854e3f8be6fe11679ae0e38a8c0008d2fe493a05f1a613efb418bd8c42e36faf9498d8ecd15dc2f8424790ad5407c44fc184c996efbb8