Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 02:43
Static task
static1
Behavioral task
behavioral1
Sample
97ac68d72812a7b31de91271f428518f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97ac68d72812a7b31de91271f428518f.exe
Resource
win10v2004-20231215-en
General
-
Target
97ac68d72812a7b31de91271f428518f.exe
-
Size
329KB
-
MD5
97ac68d72812a7b31de91271f428518f
-
SHA1
ac65a1879617ce788e71286209cf726ba785f5ca
-
SHA256
a8c59abed8d4a8dd3e5caec2b1b8632d43941ce962039991aaa2feb1be61267d
-
SHA512
d7941bfd72c6889a86f37ba7deebc455111b979cdb6220dc0d7ca359d4a32f9645441609bb428d71395b81197fc22e9e26139c53f6954711dbcbe9f93def6035
-
SSDEEP
6144:s/g/J/4Qk2vz3AW1n6TF5gcueFwgOCzQ7UffswixccY/nDy9ixs55WSyj+hg:s/g/J/4hOO5hFwtgFixc/dxi5Iq
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2660 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2860 oeioak.exe -
Loads dropped DLL 3 IoCs
pid Process 2660 cmd.exe 2660 cmd.exe 2860 oeioak.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2772 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2096 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2772 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe 2860 oeioak.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2660 2516 97ac68d72812a7b31de91271f428518f.exe 28 PID 2516 wrote to memory of 2660 2516 97ac68d72812a7b31de91271f428518f.exe 28 PID 2516 wrote to memory of 2660 2516 97ac68d72812a7b31de91271f428518f.exe 28 PID 2516 wrote to memory of 2660 2516 97ac68d72812a7b31de91271f428518f.exe 28 PID 2660 wrote to memory of 2772 2660 cmd.exe 30 PID 2660 wrote to memory of 2772 2660 cmd.exe 30 PID 2660 wrote to memory of 2772 2660 cmd.exe 30 PID 2660 wrote to memory of 2772 2660 cmd.exe 30 PID 2660 wrote to memory of 2096 2660 cmd.exe 32 PID 2660 wrote to memory of 2096 2660 cmd.exe 32 PID 2660 wrote to memory of 2096 2660 cmd.exe 32 PID 2660 wrote to memory of 2096 2660 cmd.exe 32 PID 2660 wrote to memory of 2860 2660 cmd.exe 33 PID 2660 wrote to memory of 2860 2660 cmd.exe 33 PID 2660 wrote to memory of 2860 2660 cmd.exe 33 PID 2660 wrote to memory of 2860 2660 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\97ac68d72812a7b31de91271f428518f.exe"C:\Users\Admin\AppData\Local\Temp\97ac68d72812a7b31de91271f428518f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2516 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\97ac68d72812a7b31de91271f428518f.exe" & start C:\Users\Admin\AppData\Local\oeioak.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 25163⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2096
-
-
C:\Users\Admin\AppData\Local\oeioak.exeC:\Users\Admin\AppData\Local\oeioak.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2860
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
329KB
MD597ac68d72812a7b31de91271f428518f
SHA1ac65a1879617ce788e71286209cf726ba785f5ca
SHA256a8c59abed8d4a8dd3e5caec2b1b8632d43941ce962039991aaa2feb1be61267d
SHA512d7941bfd72c6889a86f37ba7deebc455111b979cdb6220dc0d7ca359d4a32f9645441609bb428d71395b81197fc22e9e26139c53f6954711dbcbe9f93def6035