Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 19:55
Static task
static1
Behavioral task
behavioral1
Sample
512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4.exe
Resource
win10v2004-20240226-en
General
-
Target
512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4.exe
-
Size
23KB
-
MD5
1a0e4ff688924350a1b2e0d8aa9a347f
-
SHA1
871c903a6785c9494ae58689395cd1317bf55789
-
SHA256
512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4
-
SHA512
0a6ce35144cfcb7c7ed48c7ea8532a7f73d1a4d0902534937c5071e99bb80c97c6338ea83b8653497ea0c12ae72c3c3cd9710de8884fab08195eb195ed12ea89
-
SSDEEP
384:KICKqPF/EkecA6C1VqahohtgVRNVdoV7TtRu8rM/dWwYVFl2g5coW58dO0xXHV2Y:7qPJtecA6C1VqahohtgVRNToV7TtRu8x
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1872 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 1872 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2148 wrote to memory of 1872 2148 512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4.exe 28 PID 2148 wrote to memory of 1872 2148 512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4.exe 28 PID 2148 wrote to memory of 1872 2148 512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4.exe 28 PID 2148 wrote to memory of 1872 2148 512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4.exe"C:\Users\Admin\AppData\Local\Temp\512f2391430bcdd2773c98acd2690601b8a402f4cea9ae55fb30988c25ce05d4.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:1872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD557c22107c971c8ae9be5f758e8903c81
SHA13c228602b044a6b9105710f4455f5e10097515fc
SHA256e8b689d33587624347c8e79ea9c6a7f0212c4afd0aa389398a427678f31eb56c
SHA512c5ca92bcfe947db1ae2324bd7708626acb76478e99ef84751bbb867750f5dbea88206de02f94b30b533d5c14cf689ab3847345067d6943b4018fc25a8f2de025