Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
b8c1fa7b9f8818580e6531103672dade.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b8c1fa7b9f8818580e6531103672dade.exe
Resource
win10v2004-20240226-en
General
-
Target
b8c1fa7b9f8818580e6531103672dade.exe
-
Size
152KB
-
MD5
b8c1fa7b9f8818580e6531103672dade
-
SHA1
83e19142d500dca959dfd159c33ee857df953fe5
-
SHA256
d59673c999f3f442f8e3408400e963f96c0ff441b9478e90a86026de41a9e487
-
SHA512
b3b05f1cdc44c84416a122bbde77c1de5b4e3d41a71d3883c10fcf851edd3a33c755ec9f648930ee953192f1581f4c55f3e1127ccdd404596f0529b8316e7369
-
SSDEEP
3072:UpNlV8gSvbLlf+U704ChxTQqh7/28guGE0ocENjMdr:UpNlVIlGd4CFh7/28gUQ
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\dllcache\\zreportbugs.exe," b8c1fa7b9f8818580e6531103672dade.exe -
Deletes itself 1 IoCs
pid Process 1272 cmd.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dllcache\zreportbugs.exe b8c1fa7b9f8818580e6531103672dade.exe File created C:\Windows\SysWOW64\dllcache\zreportbugs.exe b8c1fa7b9f8818580e6531103672dade.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1228 b8c1fa7b9f8818580e6531103672dade.exe 1228 b8c1fa7b9f8818580e6531103672dade.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1228 b8c1fa7b9f8818580e6531103672dade.exe 1228 b8c1fa7b9f8818580e6531103672dade.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1228 wrote to memory of 1272 1228 b8c1fa7b9f8818580e6531103672dade.exe 28 PID 1228 wrote to memory of 1272 1228 b8c1fa7b9f8818580e6531103672dade.exe 28 PID 1228 wrote to memory of 1272 1228 b8c1fa7b9f8818580e6531103672dade.exe 28 PID 1228 wrote to memory of 1272 1228 b8c1fa7b9f8818580e6531103672dade.exe 28 PID 1272 wrote to memory of 2772 1272 cmd.exe 30 PID 1272 wrote to memory of 2772 1272 cmd.exe 30 PID 1272 wrote to memory of 2772 1272 cmd.exe 30 PID 1272 wrote to memory of 2772 1272 cmd.exe 30 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2772 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe"C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\attrib.exeattrib -a -r -s -h " C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe"3⤵
- Views/modifies file attributes
PID:2772
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
289B
MD534f9df4592140de286f3d5a50ce349a8
SHA179be6a924c55608bbaee413b89a30a01be1debd5
SHA2564a616ee615eabfb9d2ff931fb94c921b4bbd07a52316ea13500f5a6aeb60725d
SHA512710898c052418788ead94cf55ef4e1fed41ebc4c4ba2fce5a1d2167db9d431d9cc612e9667921c61ab1fd3f47b8296e9857f05677444c02e7845b25820698e57