Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
9b51a5efe3ee8ab6d2ce19e4e56d0357.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9b51a5efe3ee8ab6d2ce19e4e56d0357.exe
Resource
win10v2004-20231215-en
General
-
Target
9b51a5efe3ee8ab6d2ce19e4e56d0357.exe
-
Size
211KB
-
MD5
9b51a5efe3ee8ab6d2ce19e4e56d0357
-
SHA1
35d876a14a3a8f7a15e4f39a7cbbce6b1f35078f
-
SHA256
744c68306b42089e9aa6521db82dbafca142d642b8c7eb0c9b6747bf68d0b8d3
-
SHA512
9458551ccd0c57f3de817e8132fc30f0325080a44d2c8eed9065f14419957868a3016f628629e3f81ec6978880a4b9b4399647e45c9611518fec45fcf66d3f31
-
SSDEEP
3072:0GwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:0G/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2364 svchost.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\79a06283 = "7\fL\abÙ–I\x1bU¤N>×7>wPˆ`õ%aÏ8|\x10Õ#‚IÖwv°Pk÷g¦Æë\x13B»–›À«s_0[_Ï£€¬ÃOôÛœ?kÛão¾\x0e²°âS[Óæ§rX߯CxF\x0f²¤'Ç\u008f£®^\u008f»ç\x7f\x1eúž\x14ú&Œã»‡«Âs7¢N\x03\x14ž\x03" 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\79a06283 = "7\fL\abÙ–I\x1bU¤N>×7>wPˆ`õ%aÏ8|\x10Õ#‚IÖwv°Pk÷g¦Æë\x13B»–›À«s_0[_Ï£€¬ÃOôÛœ?kÛão¾\x0e²°âS[Óæ§rX߯CxF\x0f²¤'Ç\u008f£®^\u008f»ç\x7f\x1eúž\x14ú&Œã»‡«Âs7¢N\x03\x14ž\x03" svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\svchost.exe 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe File opened for modification C:\Windows\apppatch\svchost.exe 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe 2364 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3524 wrote to memory of 2364 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe 84 PID 3524 wrote to memory of 2364 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe 84 PID 3524 wrote to memory of 2364 3524 9b51a5efe3ee8ab6d2ce19e4e56d0357.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b51a5efe3ee8ab6d2ce19e4e56d0357.exe"C:\Users\Admin\AppData\Local\Temp\9b51a5efe3ee8ab6d2ce19e4e56d0357.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
PID:2364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
2KB
MD5725409de8fcc3f613155e614e6988910
SHA1ea3447239f4f3b559464104f979794fd489f5563
SHA256a83f25eed899d1e2ad725432d9ed15826475a519522a3df8dbadf6a6aa9f50d5
SHA512d5250a92216115ca900fbbbc5c315820b491901fd040a233ac9b92cf44a5bc865f7a9bb0741d7563a7791f2af53fe71b01ea24cd322c1604ce4d367c60b89bad
-
Filesize
1KB
MD5ee859d7cfdd1c1cb443a268d62a305a1
SHA1db5c78af22eb4c167a9a1316a72c840e5a5f77bb
SHA256d47f95699d74aa4eb0a83cb792ff107e94c4a48ca036b9313056d97fce551b18
SHA512dfaa32a6d29d2a01fb0445a356c9b2546f1685907f05d71ea6d6a559277ae2073d6631a79f47fe3214979ac644a01d54a9bf64c770273ec53478101e7b2632e4
-
Filesize
481B
MD5fdb8e6faa8609a028297daac4eac1eb5
SHA13d1416df18a32bea89d30e5e08552a1eac355859
SHA256d1cbcc8d6fc54d03289bf0e84794b3a0d3ea0517d162bf1733f8ebb7c5110878
SHA512f9c7bec5ae52d2533b1af18a690214c667bda22f14d9d12dd0d68e235347c5dd33b40f4c6634ec0555e8b65c4361140fe5ddc8bd6f144ee986ffeecf872ff1d2
-
Filesize
1KB
MD553a93812117015375bddb4d444a41312
SHA181dba2476583928f70f0c83be91f1bb5149f66e8
SHA2561340b12d970b09506bd0af3b1b64d869a95380965900ad275fcb024eaa529a32
SHA512f8e9d8f98bd47c5b36709b434bd4b3acb4b033c6c35e641762e00ae344481752d94d682419704e1c5d3098a2a2cbb0b03747d50534008b4e39e6fa92226b7aa4
-
Filesize
22KB
MD53d9f0fe82f592fd9409ca76b5baee217
SHA1f5de8a79988d394b0b85b67c7dc3efcce766ceab
SHA2563318bdd1a6b29bae7de3286a7933d7704715ec0183475552b61dbe5c652692b9
SHA512f48dddcabafbb308a3b7442f9323a696876efee4270952f0e3c09549e81fa05b254dcfa3e633f8a99a452a8ae732dff74b9d88534a130c19669370464eb6866d
-
Filesize
481B
MD5c0b97e3b9610017ed7591a997cf706f7
SHA116c2254300ed09453204b6f55bc0d305038b2f89
SHA25615ddaf050fe9763416982fccbf9bba59477efc970da567d217304b7150aa4457
SHA5126d0acb71eb4ce02d49494c3ee38429a0c738f236a388d33aa94917effee0c2c74a3480f2a459dcc79c689c6e99f090419e66a771a746c1875839f9b96eea8137
-
Filesize
42KB
MD5db5d0d4fa484a4678be5dd48b8e44f39
SHA1addcd23cd2c565ec6e0f628d9c97422f09e485d1
SHA256d774cbcaa48c95ac9146b78f68347eec66eb74b3216410dc6c7fd4a01bafcf64
SHA512d2739a584045bdc0ddada27424bd884e7444461d4125bb056d40076ac3caca7521215045d72b6283511f5580e2a9a8c17aa2c383b251c7dda8e1a720fa554ec3
-
Filesize
315B
MD5b0e58b5c7f1a13dc54919f55661a957e
SHA19575c07248ff0257e88e7a053b421e067a6e9f81
SHA2568167c759b25907ab300486653a68223495399f7b4c5d62c7432e9e000df514f8
SHA5127e736a9627f84490cdb7ed1adbe3a905a74c2aedbec161cfe800ec6f3fd0ab5263583987e421a703fab1b373d1e7388e34d4d974e7b53518e874a473e061a7ca
-
Filesize
23KB
MD500b0526a190cc145ec9fe8cb31a6352f
SHA19dd217e92cb3c6e9082643d977874623784f5053
SHA256cf90622b16d325528c3b95449fc7b3c30636a52455c16e90b1e71fef39de67fc
SHA512623b48a1ca1cf3e461835aa3a726ad7ff35eb9e0954f52ba15b2301d4457d4e3e076d17333edd610a1384f1e1a7d2fbba082b708c6ff12f3ec250591783290a3
-
Filesize
2KB
MD5a8fdd0012e6998420474a0c0669327c4
SHA1aa0b687e766c259a247c16677f4c631ce542fc6e
SHA25685a0119ffb919c7b1157dabbc8e40897f97ce6544f89931e503564966057d5d6
SHA512bd834b7119f51ef0c741d2c0696e449e13a003140ad631f5e272130cac2d30f8cb25a5e76cc415ddf6208ee920efed6c7c33519b8f1bd02dd4ae8d3f39e926f5
-
Filesize
2KB
MD5c1a8667b6ac05935847f4fcf6db3237d
SHA12dbfe6b587fa663f2a30ff5bf08bd6e000ea13ef
SHA256e2fbbebe76c439a6831280f3e13858962710f3f7811ff500905a2d5c488294e4
SHA512aaa6e8b1fc514ea30846acdf7daccadca9a386318c3dd169e76c07f9bdb6e2c9ee57a3ea17169198babe9d5d5c62d7b76ac4e8b3ccb34b04185782fd656b53b1
-
Filesize
211KB
MD53f76aead857771996efdb7a163c2c88d
SHA150d6ea8881940b002f2124fa1a88be11f3139197
SHA2567f3fbab7cbe648a40577110f716a44d94181b247a66a0e4967f826fcf0ea05af
SHA5127a6d40a153bed6d269c46583fba933732f09c44a974c687b149b6bf8d73f4e86ce2370998ed4e147692511f39bffcdd8a0dd40d9e9541d5dbf7f6f5c561db0fc