Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 12:03
Static task
static1
Behavioral task
behavioral1
Sample
abd5bc4c0ae51f1cbff6215bd4c7db1b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
abd5bc4c0ae51f1cbff6215bd4c7db1b.exe
Resource
win10v2004-20240226-en
General
-
Target
abd5bc4c0ae51f1cbff6215bd4c7db1b.exe
-
Size
11.5MB
-
MD5
abd5bc4c0ae51f1cbff6215bd4c7db1b
-
SHA1
78f1c2d2696d42c971f7aac2a5a9e4054ff156c3
-
SHA256
1034116ab8df2f195badd17f38b4628e3ba7251dcd2e62d7dd34bc2c2791eb82
-
SHA512
7fbfbeb41c05b7c688b2ca4f9eda3bc6f5a6021f4024c67a647b88c3bbdfec258a3d81540ef951f938689b4aa10e75c697a4533014cd34ddf2426aa7a9949b40
-
SSDEEP
196608:nrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrL:
Malware Config
Extracted
tofsee
43.231.4.6
lazystax.ru
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ojoxetab = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2784 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ojoxetab\ImagePath = "C:\\Windows\\SysWOW64\\ojoxetab\\jnyqubci.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 1640 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2656 jnyqubci.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2656 set thread context of 1640 2656 jnyqubci.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2828 sc.exe 2660 sc.exe 2664 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2488 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 28 PID 1884 wrote to memory of 2488 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 28 PID 1884 wrote to memory of 2488 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 28 PID 1884 wrote to memory of 2488 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 28 PID 1884 wrote to memory of 2592 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 30 PID 1884 wrote to memory of 2592 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 30 PID 1884 wrote to memory of 2592 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 30 PID 1884 wrote to memory of 2592 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 30 PID 1884 wrote to memory of 2828 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 32 PID 1884 wrote to memory of 2828 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 32 PID 1884 wrote to memory of 2828 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 32 PID 1884 wrote to memory of 2828 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 32 PID 1884 wrote to memory of 2660 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 34 PID 1884 wrote to memory of 2660 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 34 PID 1884 wrote to memory of 2660 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 34 PID 1884 wrote to memory of 2660 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 34 PID 1884 wrote to memory of 2664 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 36 PID 1884 wrote to memory of 2664 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 36 PID 1884 wrote to memory of 2664 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 36 PID 1884 wrote to memory of 2664 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 36 PID 1884 wrote to memory of 2784 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 39 PID 1884 wrote to memory of 2784 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 39 PID 1884 wrote to memory of 2784 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 39 PID 1884 wrote to memory of 2784 1884 abd5bc4c0ae51f1cbff6215bd4c7db1b.exe 39 PID 2656 wrote to memory of 1640 2656 jnyqubci.exe 41 PID 2656 wrote to memory of 1640 2656 jnyqubci.exe 41 PID 2656 wrote to memory of 1640 2656 jnyqubci.exe 41 PID 2656 wrote to memory of 1640 2656 jnyqubci.exe 41 PID 2656 wrote to memory of 1640 2656 jnyqubci.exe 41 PID 2656 wrote to memory of 1640 2656 jnyqubci.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\abd5bc4c0ae51f1cbff6215bd4c7db1b.exe"C:\Users\Admin\AppData\Local\Temp\abd5bc4c0ae51f1cbff6215bd4c7db1b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ojoxetab\2⤵PID:2488
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jnyqubci.exe" C:\Windows\SysWOW64\ojoxetab\2⤵PID:2592
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ojoxetab binPath= "C:\Windows\SysWOW64\ojoxetab\jnyqubci.exe /d\"C:\Users\Admin\AppData\Local\Temp\abd5bc4c0ae51f1cbff6215bd4c7db1b.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2828
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ojoxetab "wifi internet conection"2⤵
- Launches sc.exe
PID:2660
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ojoxetab2⤵
- Launches sc.exe
PID:2664
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2784
-
-
C:\Windows\SysWOW64\ojoxetab\jnyqubci.exeC:\Windows\SysWOW64\ojoxetab\jnyqubci.exe /d"C:\Users\Admin\AppData\Local\Temp\abd5bc4c0ae51f1cbff6215bd4c7db1b.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:1640
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.7MB
MD5f3fc0a822371873b1847e68c66be4e7c
SHA1c4be43cd747276600372acf2aaac4b1d4180b060
SHA256c9f0871d30460e1ec3630fc9fb8c6ed786f08c7a768cef6c5c92b61aa13dcff4
SHA512638151e69aef63a0c5a9b638154a4e06cb0a358ac10109fa6049827655ff19b29346be0d975d6345849426ac252ae356389a3735587ab95ad61b0880fc96c6b2
-
Filesize
960KB
MD5746623b839c07ea4e1ed985a72727c7c
SHA16bbb6048330f0b1f71a39f1ae4c50cda9e3434ed
SHA25601c2638d4a70b56763d3a76dcad7c3013fa2d7cacc8cf8f005a0798c294fb436
SHA512dc4d795003b6d73e97170a4e75d8fd84e4a6005c0b54d17bf9dc0d19fa4f99abba82569f4bd277acc6cb9e2c2ee5419bc30c70f7516f50819cec54d75547a63e