Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/02/2024, 02:33
Static task
static1
Behavioral task
behavioral1
Sample
637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe
Resource
win10v2004-20240221-en
General
-
Target
637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe
-
Size
779KB
-
MD5
29ed8ed38aa3310224ef25972588a369
-
SHA1
d7ff6bc8075abd5f500d10994061c737ede21740
-
SHA256
637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787
-
SHA512
e42a55fa01a6b8340c087f7ac15d117933baa91467777f25a7868629d48db2fc6703e3d976e1da4a160d9c20383a8d5ce75f52e8e2425c9f4126aab39e11ca9b
-
SSDEEP
12288:xPJTcmjRN6KSYqk5lvgKTgt9awhBcxetQmBVRTqeRKwpNtW4fo:lJ4m9iyv28whSwNBVRTwwpK
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
pid Process 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe -
Executes dropped EXE 1 IoCs
pid Process 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe -
Loads dropped DLL 1 IoCs
pid Process 1500 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\trkcore = "C:\\ProgramData\\Microsoft\\Roaming\\svchost.exe" 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 11 pastebin.com 13 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2840 explorer.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1500 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2840 explorer.exe Token: SeShutdownPrivilege 2840 explorer.exe Token: SeShutdownPrivilege 2840 explorer.exe Token: SeShutdownPrivilege 2840 explorer.exe Token: SeShutdownPrivilege 2840 explorer.exe Token: SeShutdownPrivilege 2840 explorer.exe Token: SeShutdownPrivilege 2840 explorer.exe Token: SeShutdownPrivilege 2840 explorer.exe Token: SeShutdownPrivilege 2840 explorer.exe Token: SeShutdownPrivilege 2840 explorer.exe Token: SeShutdownPrivilege 2840 explorer.exe Token: SeShutdownPrivilege 2840 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe -
Suspicious use of SendNotifyMessage 19 IoCs
pid Process 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe 2840 explorer.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3004 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1500 wrote to memory of 3004 1500 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 28 PID 1500 wrote to memory of 3004 1500 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 28 PID 1500 wrote to memory of 3004 1500 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 28 PID 1500 wrote to memory of 3004 1500 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe 28 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" 637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe"C:\Users\Admin\AppData\Local\Temp\637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exeC:\Users\Admin\AppData\Local\Temp\637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- System policy modification
PID:3004
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:2836
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
\Users\Admin\AppData\Local\Temp\637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe
Filesize779KB
MD5ede5675d1a348880a9befe1b76d4f735
SHA19612f867b00922aa19971695a33814647176c4e2
SHA25693eb21cc59f347c0b7792dcf922b45d892f4543d1b812c46ba37460ca7f1c510
SHA51284fcc50626fbb33839ace8e16904dfd9a53c810e99ce67f55715aa9d387a87eb6ddc46bfd2e2531a777a527b509856f67031ada0308a51b906c905d9f683f1a3