Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/03/2024, 00:37

General

  • Target

    b61470a1038947af79e297fe6cc8254073ebac72f5bec5785e458bbb1197d15f.exe

  • Size

    206KB

  • MD5

    cc46def2c67d319aec841722dff26c03

  • SHA1

    dcc8f27c4fd27152172ff2bedba3ea5c552248a9

  • SHA256

    b61470a1038947af79e297fe6cc8254073ebac72f5bec5785e458bbb1197d15f

  • SHA512

    a4e08a42cdf1570c4ac16c890bb9c6272b48f0f10126dc566aa715d7400c71e975adc7b5447afa51f1dcd47a6781b3962c56cc80e587ef90c481b5f95a311b03

  • SSDEEP

    1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJds:/VqoCl/YgjxEufVU0TbTyDDalbs

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b61470a1038947af79e297fe6cc8254073ebac72f5bec5785e458bbb1197d15f.exe
    "C:\Users\Admin\AppData\Local\Temp\b61470a1038947af79e297fe6cc8254073ebac72f5bec5785e458bbb1197d15f.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2980
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2028
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2640
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2128
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2544
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 00:39 /f
            5⤵
            • Creates scheduled task(s)
            PID:2428
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 00:40 /f
            5⤵
            • Creates scheduled task(s)
            PID:528
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 00:41 /f
            5⤵
            • Creates scheduled task(s)
            PID:1612
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      206KB

      MD5

      4b5948abaf6ef3420da5e2e4d1bdb1fe

      SHA1

      807d4e5f21d9cc64a7a7408a9465c7ab2a3bf238

      SHA256

      11f023dc8b535ba8813672496f6f7f84c2ed964a732cfbb05e7c1404840d8854

      SHA512

      7b6022d152964f42fb49836c7b75ee72701310d5c756458f9a406cdbe54fbb6441f78e0587bb6c640765c33bb8ebe324dc20a8bb28b4b690c3e4b60f889ad76b

    • \Windows\Resources\spoolsv.exe

      Filesize

      206KB

      MD5

      3c27ebf2245937907356cef32cc7e796

      SHA1

      c6bf619a43ac6d4fc67957bf6c275807b170cd2f

      SHA256

      f177999da38b579b2f8031de26c56477a704f54fa9d00f2135a5cd60561dba04

      SHA512

      f3a2ed48f2b0bf95f42bc42ef914fc45ccd03f0cf1c7b056ee7775a72862d204470c0f20ebc17d1c594489978c31d5b9715cd70a73cf2490720ec0c27f0eddcd

    • \Windows\Resources\svchost.exe

      Filesize

      206KB

      MD5

      c19f83ebdb95db941731a759a1fd1de3

      SHA1

      f38cf9e0bee79ad6fe6a4137efb7833315022326

      SHA256

      9cced17b406a08b4237c54151b6eb937abc62e61a7004920b7c752fd73ef28eb

      SHA512

      0b79a71217da2a662096002d885a29ea49d6a85717731b13be6eca57c88f4caf9e93e368315875eb17007e018b816bd80b4fdcf319e3bafbfa7fe80246e5642c

    • memory/2544-50-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2640-51-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2980-0-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

    • memory/2980-12-0x0000000000370000-0x000000000039F000-memory.dmp

      Filesize

      188KB

    • memory/2980-52-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB