Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 02:30
Static task
static1
Behavioral task
behavioral1
Sample
1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe
Resource
win10v2004-20231215-en
General
-
Target
1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe
-
Size
843KB
-
MD5
a194de24dfbba6afe8153b8a7d593e7e
-
SHA1
dd9e65550462722c10a07a6018ddc3fade4b1406
-
SHA256
1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b
-
SHA512
4f702036655b07112ccd9effc1602b92e1ec08edfe32a3ff649423a0ee6cc9a7897fb1404c13a3569e1bf1cd3d9d341d5f179038bb4c3f769c4472feb5567e20
-
SSDEEP
24576:yxYS04YNEMuExDiU6E5R9s8xY/2l/dqLc83oIbt+ri:yxA4auS+UjfU2TAt3oIbt+r
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2168 AudioDriver.exe -
Loads dropped DLL 1 IoCs
pid Process 2240 1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe 2168 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2168 AudioDriver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2168 AudioDriver.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2168 AudioDriver.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2168 2240 1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe 28 PID 2240 wrote to memory of 2168 2240 1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe 28 PID 2240 wrote to memory of 2168 2240 1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe 28 PID 2240 wrote to memory of 2168 2240 1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe"C:\Users\Admin\AppData\Local\Temp\1a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
821KB
MD5999ee84f3d506e3413c8fa2d2b6e1eee
SHA11153f10ed80cdbc93bec3780cf9dc909ba724b68
SHA256b2b51bd33016357130f7bc420a439963af8d95e57b42788e1e3bb7fdf46c1d1b
SHA51280c369e87a8fae3734889f2628a4c80bb7e97ddf40a51ce6a7a0d71fdb0b1cc3d5059dc4444e1536e69575ed692356c70bc6308bfa53f0a7bf51c66b3e9ca996
-
Filesize
843KB
MD5a194de24dfbba6afe8153b8a7d593e7e
SHA1dd9e65550462722c10a07a6018ddc3fade4b1406
SHA2561a922971e8d5fa8744a85a508a90d81b5d7fa6b024400af40ca29433dc2da43b
SHA5124f702036655b07112ccd9effc1602b92e1ec08edfe32a3ff649423a0ee6cc9a7897fb1404c13a3569e1bf1cd3d9d341d5f179038bb4c3f769c4472feb5567e20