Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
233s -
max time network
286s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 17:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b93d9fe6206f8ca5334018fe6d0e2b7c.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
b93d9fe6206f8ca5334018fe6d0e2b7c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
b93d9fe6206f8ca5334018fe6d0e2b7c.exe
-
Size
577KB
-
MD5
b93d9fe6206f8ca5334018fe6d0e2b7c
-
SHA1
5430760ef7bac294e7a72d80450d035183685ddb
-
SHA256
54612d254ac274dc79c3edf66d2a1c09207fbcb5709c48b2cf7841559539f2bf
-
SHA512
5a25f45638831c2687f80cb7586e941fa225dbc24face127686c3ef697d03a5f2c398e41c9821b1693e0e9645799c05c2b162d6fe08ac2043ab813d1f1566ecb
-
SSDEEP
12288:d0txg4xVB5qisrZEYGFcrPLIHsKSFi3EDER7iMKt1oPv:d8Bxpq9zGIz6SFEEDIWXje
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: b93d9fe6206f8ca5334018fe6d0e2b7c.exe File opened (read-only) \??\A: b93d9fe6206f8ca5334018fe6d0e2b7c.exe File opened (read-only) \??\K: b93d9fe6206f8ca5334018fe6d0e2b7c.exe File opened (read-only) \??\J: b93d9fe6206f8ca5334018fe6d0e2b7c.exe File opened (read-only) \??\I: b93d9fe6206f8ca5334018fe6d0e2b7c.exe File opened (read-only) \??\H: b93d9fe6206f8ca5334018fe6d0e2b7c.exe File opened (read-only) \??\G: b93d9fe6206f8ca5334018fe6d0e2b7c.exe File opened (read-only) \??\E: b93d9fe6206f8ca5334018fe6d0e2b7c.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 b93d9fe6206f8ca5334018fe6d0e2b7c.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Tunmbs.db b93d9fe6206f8ca5334018fe6d0e2b7c.exe File opened for modification C:\Windows\SysWOW64\Tunmbs.db b93d9fe6206f8ca5334018fe6d0e2b7c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe 2804 b93d9fe6206f8ca5334018fe6d0e2b7c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b93d9fe6206f8ca5334018fe6d0e2b7c.exe"C:\Users\Admin\AppData\Local\Temp\b93d9fe6206f8ca5334018fe6d0e2b7c.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2804