Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09/03/2024, 18:23
General
-
Target
02fec5710656ad9adb7b1540e80eb42bcd7a44c09b0a1542c81bfc0bb474bc32.exe
-
Size
833KB
-
MD5
012fc9ab793f339043fe88eb3e28996f
-
SHA1
ca2000d8fb282a8d8e24e2b7f079455341f5ac9a
-
SHA256
02fec5710656ad9adb7b1540e80eb42bcd7a44c09b0a1542c81bfc0bb474bc32
-
SHA512
8d5f7cd85ca6b18b3361360f6174be54e437cf61d420c60400a34ea972dbd9b6381280614f63a887e91552ba874a60a6209d6d388ab8ac2593034e45faf138eb
-
SSDEEP
24576:8wj7QpalR342ddHjXglpvvB2+R4QmX8T4:8wjMpal5d8lph2+Rlmx
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies data under HKEY_USERS 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02fec5710656ad9adb7b1540e80eb42bcd7a44c09b0a1542c81bfc0bb474bc32.exe"C:\Users\Admin\AppData\Local\Temp\02fec5710656ad9adb7b1540e80eb42bcd7a44c09b0a1542c81bfc0bb474bc32.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HKFX20~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HKFX20~1.EXE2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\www.cmder.com.exeC:\Windows\www.cmder.com.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
468KB
MD573b138e63de1f1efb03859d334313bc8
SHA1778b926faf84ada04c3eac712e62fe69d804f1ce
SHA2569e72b0bebd1a70edb51637991714fe1557635fe302cc5e49c74abfadcf7799ec
SHA5123b18012a2d0800bd869b0890ea9341bfbe812a2535de7eb07917b1d771824ffd3c5966cbd2dd8bd8f6faef191f50280244ae2b5c8c24377122d848dcbc83d371
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
336KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
912KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
912KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
912KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
912KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
912KB
-
Filesize
912KB