Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 06:08
Static task
static1
Behavioral task
behavioral1
Sample
a1234afaf3fec88126e282ddb4ccb052.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a1234afaf3fec88126e282ddb4ccb052.exe
Resource
win10v2004-20240221-en
General
-
Target
a1234afaf3fec88126e282ddb4ccb052.exe
-
Size
687KB
-
MD5
a1234afaf3fec88126e282ddb4ccb052
-
SHA1
8c00e0df60feec0254a54cd0edb4327cdac2cdb8
-
SHA256
dccca60d7f67e773dce519de7e535f95880d08c6692966693592467fdfedc72b
-
SHA512
c0ecb2ff756225c446f34abb45503ecd52547dc63da42db5229f759fb30001fa42b1c7a877740fe23095fa0b6e367f6cbc38f34d53d9de20b328d4e70b3479e3
-
SSDEEP
12288:rKqI/NVA4LuX1rTcMYWnXUOC+0b4ZCOh+F3Z4mxxODRw2RaeoWgxRBuMr:rZI/NulfXYeU/Tc0Oh+QmX8RwaaeqTxr
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2556 4.exe 2988 server.exe -
Loads dropped DLL 2 IoCs
pid Process 2932 a1234afaf3fec88126e282ddb4ccb052.exe 2932 a1234afaf3fec88126e282ddb4ccb052.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a1234afaf3fec88126e282ddb4ccb052.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat server.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\uninstal.bat 4.exe File created C:\Windows\server.exe 4.exe File opened for modification C:\Windows\server.exe 4.exe -
Modifies data under HKEY_USERS 28 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" server.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-f7-83-59-d2-12\WpadDecisionTime = 80807cdfe766da01 server.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-f7-83-59-d2-12\WpadDecision = "0" server.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings server.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3236FCB5-E1D7-417B-9E2D-60D2DE445119} server.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3236FCB5-E1D7-417B-9E2D-60D2DE445119}\WpadDecisionTime = 80807cdfe766da01 server.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-f7-83-59-d2-12\WpadDetectedUrl server.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0136000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 server.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections server.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 server.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3236FCB5-E1D7-417B-9E2D-60D2DE445119}\02-f7-83-59-d2-12 server.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" server.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings server.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3236FCB5-E1D7-417B-9E2D-60D2DE445119}\WpadDecisionReason = "1" server.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-f7-83-59-d2-12 server.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" server.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0136000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 server.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad server.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3236FCB5-E1D7-417B-9E2D-60D2DE445119}\WpadNetworkName = "Network 3" server.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-f7-83-59-d2-12\WpadDecisionReason = "1" server.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-f7-83-59-d2-12\WpadDecisionTime = a0a6d91de866da01 server.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 server.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3236FCB5-E1D7-417B-9E2D-60D2DE445119}\WpadDecisionTime = a0a6d91de866da01 server.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3236FCB5-E1D7-417B-9E2D-60D2DE445119}\WpadDecision = "0" server.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" server.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" server.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix server.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ server.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2556 4.exe Token: SeDebugPrivilege 2988 server.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 server.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2556 2932 a1234afaf3fec88126e282ddb4ccb052.exe 28 PID 2932 wrote to memory of 2556 2932 a1234afaf3fec88126e282ddb4ccb052.exe 28 PID 2932 wrote to memory of 2556 2932 a1234afaf3fec88126e282ddb4ccb052.exe 28 PID 2932 wrote to memory of 2556 2932 a1234afaf3fec88126e282ddb4ccb052.exe 28 PID 2988 wrote to memory of 2644 2988 server.exe 30 PID 2988 wrote to memory of 2644 2988 server.exe 30 PID 2988 wrote to memory of 2644 2988 server.exe 30 PID 2988 wrote to memory of 2644 2988 server.exe 30 PID 2556 wrote to memory of 2456 2556 4.exe 31 PID 2556 wrote to memory of 2456 2556 4.exe 31 PID 2556 wrote to memory of 2456 2556 4.exe 31 PID 2556 wrote to memory of 2456 2556 4.exe 31 PID 2556 wrote to memory of 2456 2556 4.exe 31 PID 2556 wrote to memory of 2456 2556 4.exe 31 PID 2556 wrote to memory of 2456 2556 4.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1234afaf3fec88126e282ddb4ccb052.exe"C:\Users\Admin\AppData\Local\Temp\a1234afaf3fec88126e282ddb4ccb052.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\uninstal.bat3⤵PID:2456
-
-
-
C:\Windows\server.exeC:\Windows\server.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵PID:2644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150B
MD55edd682a8b1f2bf873300774f954ab03
SHA12cca4e743d02dbccf31b784ea26a60c03dcc9637
SHA256a34c51ec5d2ac66ef75719e7dee61b6e89e74d054712438da2585ec92ce0865a
SHA512916f0e846a38f63aae996e2a3957fa24fed3bcaa6add68c529e3cc0aa063dca49b98d42c92317bfc2f43d745c492e1e1e6f5db0c986b9682f4b9b0cf0afd7bd2
-
Filesize
775KB
MD5dae06df43424b36cb828a7f6e7ff5f6a
SHA1c29eb9c664b0370a98869b6380f8777ac0018c05
SHA2564a08e89e44a7c7f333f5716120a3cb0fa8f14ae3559adc8f1bd7eadcc0ac5d63
SHA5129648ca7578133a5ee62666426a1c53b5a20ac59f9f204d826b6bce2df46a4340086ac259ab6b9d096c633f32af840ced3dfb3bb6029984095ff9762a302cc300