Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
9b197649ab3143aee2fd5919790929e9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9b197649ab3143aee2fd5919790929e9.exe
Resource
win10v2004-20231222-en
General
-
Target
9b197649ab3143aee2fd5919790929e9.exe
-
Size
63KB
-
MD5
9b197649ab3143aee2fd5919790929e9
-
SHA1
bc130a152f84c88126cae6e7a8d9a5b9b4e76fb8
-
SHA256
e8066f9441892d81ddf295c599597be655c9ecd1d13c90c28364c6e0d48785cd
-
SHA512
f749d3b86c5ae828d02b8c800edc34ffefc4ba89d12349e68067a9a681aac9ccbada3cdb002b63dcecf28369135df8bea16adb4552cd93e8e760a83e56d525b8
-
SSDEEP
1536:V3cpyORJLuB4P4AJJv4Romu/4awlmhpUljM7:V3c1fP4AJJv45n7jM7
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 364 cmd.exe -
Loads dropped DLL 9 IoCs
pid Process 3068 9b197649ab3143aee2fd5919790929e9.exe 3068 9b197649ab3143aee2fd5919790929e9.exe 3068 9b197649ab3143aee2fd5919790929e9.exe 3068 9b197649ab3143aee2fd5919790929e9.exe 3068 9b197649ab3143aee2fd5919790929e9.exe 3068 9b197649ab3143aee2fd5919790929e9.exe 3068 9b197649ab3143aee2fd5919790929e9.exe 3068 9b197649ab3143aee2fd5919790929e9.exe 3068 9b197649ab3143aee2fd5919790929e9.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Public\Desktop\Internat Explorar\Desktop.ini 9b197649ab3143aee2fd5919790929e9.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\tbgw.ico 9b197649ab3143aee2fd5919790929e9.exe File opened for modification C:\Windows\tbgw.ico 9b197649ab3143aee2fd5919790929e9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3068 wrote to memory of 3044 3068 9b197649ab3143aee2fd5919790929e9.exe 28 PID 3068 wrote to memory of 3044 3068 9b197649ab3143aee2fd5919790929e9.exe 28 PID 3068 wrote to memory of 3044 3068 9b197649ab3143aee2fd5919790929e9.exe 28 PID 3068 wrote to memory of 3044 3068 9b197649ab3143aee2fd5919790929e9.exe 28 PID 3068 wrote to memory of 3044 3068 9b197649ab3143aee2fd5919790929e9.exe 28 PID 3068 wrote to memory of 3044 3068 9b197649ab3143aee2fd5919790929e9.exe 28 PID 3068 wrote to memory of 3044 3068 9b197649ab3143aee2fd5919790929e9.exe 28 PID 3068 wrote to memory of 364 3068 9b197649ab3143aee2fd5919790929e9.exe 31 PID 3068 wrote to memory of 364 3068 9b197649ab3143aee2fd5919790929e9.exe 31 PID 3068 wrote to memory of 364 3068 9b197649ab3143aee2fd5919790929e9.exe 31 PID 3068 wrote to memory of 364 3068 9b197649ab3143aee2fd5919790929e9.exe 31 PID 3068 wrote to memory of 364 3068 9b197649ab3143aee2fd5919790929e9.exe 31 PID 3068 wrote to memory of 364 3068 9b197649ab3143aee2fd5919790929e9.exe 31 PID 3068 wrote to memory of 364 3068 9b197649ab3143aee2fd5919790929e9.exe 31 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3044 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b197649ab3143aee2fd5919790929e9.exe"C:\Users\Admin\AppData\Local\Temp\9b197649ab3143aee2fd5919790929e9.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" "C:\Users\Public\Desktop\Internat Explorar" +s2⤵
- Views/modifies file attributes
PID:3044
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\temp_tmp.bat" "2⤵
- Deletes itself
PID:364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186B
MD5201abfdc3aee3a5ee3aa56b1244b43fc
SHA193be220ecd25b5c9f4df2ac717651166e5712542
SHA256b42ba85ac5fc32888197efca4553031fd79c39dcc26d8a8e7192924c176c9045
SHA51246368cab07dbd1062edef235c341244135b67af8952cb7bf63f4671e032cd98e8ce962a1cec032feb6d7c99566d18bc688620a4c0f81662bca2bbe93f841695d
-
Filesize
75B
MD5254a842845d5fe636a018ed64927573f
SHA1405c601e91dbd53febdca03e5ccc1fd1b03107be
SHA256bc4eaf790a990a2dbb8460775c257f603d2303a7ab282dd5f405264af202282c
SHA512e817292fe07e880cd21e1cba72d4fec097fab51f21012a891bad6be6d43da8573a2ecc881a9c9c6a01dc421b55eb4734a79803899e51234ff4bd4c2a4a8a8acf
-
Filesize
1KB
MD5de47000f2034dc530d07da111827af57
SHA186b34f70b275ea8ee8adb869d2420e09b044718a
SHA25655375084a2fb9154a368cce0b9372ed6dd0342f11c2bdf5251ded25993714dae
SHA512beb91fbcdf3d6497d59844a6da91055b7791016bcf9d97083b6cdffc1d2ee6439322dc19e098bdf0aa27e3b600305d6064ef645a24691dcae98da519debc892f
-
Filesize
1KB
MD55ffaf2527bc8e175c988c8dc53dbc484
SHA17c069a0e54469453fdc91d57bfb0e82e2e539777
SHA2562f58298a3e901293b80ad5ebc164e53e76e079c3e86252f1b34f702c55ada96e
SHA512f90556ed1bd94a994d3a6573757f1214cfacb03ee5d6e1b8d277fb00f95371045e279b3a05189de7baf832605845d11a99196ac85de6c0ce050c611a9ab3b8ba
-
Filesize
10KB
MD5055f4f9260e07fc83f71877cbb7f4fad
SHA1a245131af1a182de99bd74af9ff1fab17977a72f
SHA2564209588362785b690d08d15cd982b8d1c62c348767ca19114234b21d5df74ddc
SHA512a8e82dc4435ed938f090f43df953ddad9b0075f16218c09890c996299420162d64b1dbfbf613af37769ae796717eec78204dc786b757e8b1d13d423d4ee82e26
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667