Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16/02/2024, 09:24
Static task
static1
Behavioral task
behavioral1
Sample
a00578f7146ca07d408809a45a1ef9eb.exe
Resource
win7-20231129-en
General
-
Target
a00578f7146ca07d408809a45a1ef9eb.exe
-
Size
1.1MB
-
MD5
a00578f7146ca07d408809a45a1ef9eb
-
SHA1
3b59cebd2112fd08fe7e128d750eb3876763a3ef
-
SHA256
57a08a9176c41262cf25a6294d7a1aebf712835eb5d64876846e1aae46d19b0d
-
SHA512
85764827c35f26a69194fb108e21c28b7a4c69346d74d344b79d6c14061828f390c3e64d94a521fcaa6ccf776723679782807efa211f325f2c1bf20807379445
-
SSDEEP
24576:4AHnh+eWsN3skA4RV1Hom2KXMmHa97aWtjzjFtuM254:/h+ZkldoPK8Ya971XjFtA4
Malware Config
Extracted
limerat
1JBKLGyE6AnRGvk92A8x3m8qmXfh3fcEty
-
aes_key
nulled
-
antivm
true
-
c2_url
https://pastebin.com/raw/cXuQ0V20
-
delay
3
-
download_payload
false
-
install
false
-
install_name
Winservices.exe
-
main_folder
AppData
-
pin_spread
false
-
sub_folder
\
-
usb_spread
true
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/cXuQ0V20
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2992 sdchange.exe 1568 sdchange.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 pastebin.com 5 pastebin.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum RegAsm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 RegAsm.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000c0000000155f7-50.dat autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2220 set thread context of 1704 2220 a00578f7146ca07d408809a45a1ef9eb.exe 28 PID 2992 set thread context of 2860 2992 sdchange.exe 34 PID 1568 set thread context of 984 1568 sdchange.exe 40 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2564 schtasks.exe 2912 schtasks.exe 3024 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1704 RegAsm.exe Token: SeDebugPrivilege 1704 RegAsm.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2220 wrote to memory of 1704 2220 a00578f7146ca07d408809a45a1ef9eb.exe 28 PID 2220 wrote to memory of 1704 2220 a00578f7146ca07d408809a45a1ef9eb.exe 28 PID 2220 wrote to memory of 1704 2220 a00578f7146ca07d408809a45a1ef9eb.exe 28 PID 2220 wrote to memory of 1704 2220 a00578f7146ca07d408809a45a1ef9eb.exe 28 PID 2220 wrote to memory of 1704 2220 a00578f7146ca07d408809a45a1ef9eb.exe 28 PID 2220 wrote to memory of 1704 2220 a00578f7146ca07d408809a45a1ef9eb.exe 28 PID 2220 wrote to memory of 1704 2220 a00578f7146ca07d408809a45a1ef9eb.exe 28 PID 2220 wrote to memory of 1704 2220 a00578f7146ca07d408809a45a1ef9eb.exe 28 PID 2220 wrote to memory of 1704 2220 a00578f7146ca07d408809a45a1ef9eb.exe 28 PID 2220 wrote to memory of 2564 2220 a00578f7146ca07d408809a45a1ef9eb.exe 29 PID 2220 wrote to memory of 2564 2220 a00578f7146ca07d408809a45a1ef9eb.exe 29 PID 2220 wrote to memory of 2564 2220 a00578f7146ca07d408809a45a1ef9eb.exe 29 PID 2220 wrote to memory of 2564 2220 a00578f7146ca07d408809a45a1ef9eb.exe 29 PID 1576 wrote to memory of 2992 1576 taskeng.exe 33 PID 1576 wrote to memory of 2992 1576 taskeng.exe 33 PID 1576 wrote to memory of 2992 1576 taskeng.exe 33 PID 1576 wrote to memory of 2992 1576 taskeng.exe 33 PID 2992 wrote to memory of 2860 2992 sdchange.exe 34 PID 2992 wrote to memory of 2860 2992 sdchange.exe 34 PID 2992 wrote to memory of 2860 2992 sdchange.exe 34 PID 2992 wrote to memory of 2860 2992 sdchange.exe 34 PID 2992 wrote to memory of 2860 2992 sdchange.exe 34 PID 2992 wrote to memory of 2860 2992 sdchange.exe 34 PID 2992 wrote to memory of 2860 2992 sdchange.exe 34 PID 2992 wrote to memory of 2860 2992 sdchange.exe 34 PID 2992 wrote to memory of 2860 2992 sdchange.exe 34 PID 2992 wrote to memory of 2912 2992 sdchange.exe 35 PID 2992 wrote to memory of 2912 2992 sdchange.exe 35 PID 2992 wrote to memory of 2912 2992 sdchange.exe 35 PID 2992 wrote to memory of 2912 2992 sdchange.exe 35 PID 1576 wrote to memory of 1568 1576 taskeng.exe 39 PID 1576 wrote to memory of 1568 1576 taskeng.exe 39 PID 1576 wrote to memory of 1568 1576 taskeng.exe 39 PID 1576 wrote to memory of 1568 1576 taskeng.exe 39 PID 1568 wrote to memory of 984 1568 sdchange.exe 40 PID 1568 wrote to memory of 984 1568 sdchange.exe 40 PID 1568 wrote to memory of 984 1568 sdchange.exe 40 PID 1568 wrote to memory of 984 1568 sdchange.exe 40 PID 1568 wrote to memory of 984 1568 sdchange.exe 40 PID 1568 wrote to memory of 984 1568 sdchange.exe 40 PID 1568 wrote to memory of 984 1568 sdchange.exe 40 PID 1568 wrote to memory of 984 1568 sdchange.exe 40 PID 1568 wrote to memory of 984 1568 sdchange.exe 40 PID 1568 wrote to memory of 3024 1568 sdchange.exe 41 PID 1568 wrote to memory of 3024 1568 sdchange.exe 41 PID 1568 wrote to memory of 3024 1568 sdchange.exe 41 PID 1568 wrote to memory of 3024 1568 sdchange.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\a00578f7146ca07d408809a45a1ef9eb.exe"C:\Users\Admin\AppData\Local\Temp\a00578f7146ca07d408809a45a1ef9eb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2564
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {D795BE3A-0145-43E2-B89C-2F1F58407521} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\secinit\sdchange.exeC:\Users\Admin\secinit\sdchange.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:2860
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2912
-
-
-
C:\Users\Admin\secinit\sdchange.exeC:\Users\Admin\secinit\sdchange.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:984
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn SettingSyncHost /tr "C:\Users\Admin\secinit\sdchange.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:3024
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
1.1MB
MD5bcdc3e907838c94e011e7f3dd5b132d9
SHA1d68c33539f55708672e3694ac570cca11f73c367
SHA2568bc339909b150a7eb98bafa94be78f3702841deaa8fc3ce61085c63ae65d0150
SHA512603b2348775955993004ddf8bdea7c5c5f279fa1ffae94ff747313b4f87793e05196ddc2dbbd4d2a0a363dd1201f424fc15afb9770b00975f392d4573ebb18e5