Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 13:52
Static task
static1
Behavioral task
behavioral1
Sample
Respecialist.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Respecialist.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
General
-
Target
Respecialist.exe
-
Size
826KB
-
MD5
bcc1f12af6334f819cac261f50fc6f3f
-
SHA1
68ef28761831b5ce423b174549f78843a8ffcbaa
-
SHA256
cadc8838c26a906f9dd9cfed178546e322f67f714d4951169482d781a07ffc98
-
SHA512
77512f726964cb995f830bfab6aa7fbec3b3a5b270b08d57d4a0395a570aa5c3b6b3185bce9bb6baf4ccafcd6260a2a514282ec45f65d6ab93dac7ac5cda4f4f
-
SSDEEP
12288:zgOiqjFiNnytiTYG8ERU8Nsb9uF/5MkQ5HOKBAUhtHuuU69E:zgYFyy4c1EdsDOSAUbPR9E
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1808 Respecialist.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Proenzym.ini Respecialist.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1808 Respecialist.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\fljetoners\monochrome.lnk Respecialist.exe File opened for modification C:\Windows\resources\sjapper\Tolvtedel.for Respecialist.exe File opened for modification C:\Windows\resources\sequoia.ini Respecialist.exe File opened for modification C:\Windows\staalhaardt\stejlepladsers.kam Respecialist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1680 1808 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1808 wrote to memory of 1680 1808 Respecialist.exe 28 PID 1808 wrote to memory of 1680 1808 Respecialist.exe 28 PID 1808 wrote to memory of 1680 1808 Respecialist.exe 28 PID 1808 wrote to memory of 1680 1808 Respecialist.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Respecialist.exe"C:\Users\Admin\AppData\Local\Temp\Respecialist.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 282⤵
- Program crash
PID:1680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51741931ca1d5fdd5b1aacd8b29239790
SHA1c89863beab16409dcfc8767975ded24aca9be269
SHA2569fb991d6f1312aa15f8ff822accfc4c4cb7354b87ff46c62d830779230cc695a
SHA512fb845c0102ed8566146150b501219222f50654a5a901ba045d3f1ebb33eb87ec00521307a3ba8e10bb330b31135a7d7636524a168b79dcdd9b625fb5b0d137b5
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9