Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
10/03/2024, 07:55
General
-
Target
be1321f0e89455a22121a114f8464564.exe
-
Size
332KB
-
MD5
be1321f0e89455a22121a114f8464564
-
SHA1
30030417ffe3d50a912773668a87fd855f412a62
-
SHA256
fd8fdd234a9b2b0707fce4d30b006722040f873f8f3b53df944fadc240142518
-
SHA512
454057d2b00582eeef38f598c9a58ba5127f5c747421aa710e353efcebcaeff652b7525592647803e6d44af750f44a21f459994aae29bfbef27a24326af60ef4
-
SSDEEP
6144:d+gB3OD1dXvmTrmgE5YzTLUlzmyksWa6mPQptW3MwO+F:doDDvmTSgE6TLUBmnzaZPQbZv
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be1321f0e89455a22121a114f8464564.exe"C:\Users\Admin\AppData\Local\Temp\be1321f0e89455a22121a114f8464564.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2352 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\be1321f0e89455a22121a114f8464564.exe" & start C:\Users\Admin\AppData\Local\ckknn.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 23523⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\ckknn.exeC:\Users\Admin\AppData\Local\ckknn.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD5be1321f0e89455a22121a114f8464564
SHA130030417ffe3d50a912773668a87fd855f412a62
SHA256fd8fdd234a9b2b0707fce4d30b006722040f873f8f3b53df944fadc240142518
SHA512454057d2b00582eeef38f598c9a58ba5127f5c747421aa710e353efcebcaeff652b7525592647803e6d44af750f44a21f459994aae29bfbef27a24326af60ef4
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
8KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
8KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
8KB