Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22/02/2024, 04:42
Static task
static1
Behavioral task
behavioral1
Sample
ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe
Resource
win10v2004-20240221-en
General
-
Target
ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe
-
Size
779KB
-
MD5
002bff6573f0e7721b37dbbaebb75d47
-
SHA1
2aea4be00024a7e4aaa2454728e10896b48bd086
-
SHA256
ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50
-
SHA512
a808744182d23640b1d944a795597cab11419c8e62646709ea4e3338de82af3c559272e28c93dc6bcc2eb6b116197dc755b3c62b5730567aff019619798a20d5
-
SSDEEP
12288:xPJTcmjRN6KSYqk5lvgKTgt9awhBcxet8mBVRTqeRKwpNtW4fo:lJ4m9iyv28whSwRBVRTwwpK
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
pid Process 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe -
Executes dropped EXE 1 IoCs
pid Process 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe -
Loads dropped DLL 1 IoCs
pid Process 2292 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\trkcore = "C:\\ProgramData\\Microsoft\\Roaming\\svchost.exe" ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 11 pastebin.com 13 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1412 explorer.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2292 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe Token: SeShutdownPrivilege 1412 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe -
Suspicious use of SendNotifyMessage 19 IoCs
pid Process 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe 1412 explorer.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2660 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2660 2292 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 28 PID 2292 wrote to memory of 2660 2292 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 28 PID 2292 wrote to memory of 2660 2292 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 28 PID 2292 wrote to memory of 2660 2292 ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe 28 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe"C:\Users\Admin\AppData\Local\Temp\ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exeC:\Users\Admin\AppData\Local\Temp\ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- System policy modification
PID:2660
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:2188
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
\Users\Admin\AppData\Local\Temp\ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe
Filesize779KB
MD5ce1ae0b780f22d4ae2101538881f7eef
SHA1390853f03821295a37f08b9f788c1615ea5097eb
SHA256d0c80620ab0397d8fbb031f234266fb6ac4d6bd41a263f75c8f41ed5a831dce7
SHA512a6f490f96bb884488b6d2bf9d6aee8a6c40ab4a95e5442c2f5cabf9eab058319d7ec257415671e85f3f7b7c90299d31b3ef3a3e8e78fbd89742d78ec24d642fe