Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
be4b9cd2e84c1744e29740cf78a374cc.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
be4b9cd2e84c1744e29740cf78a374cc.exe
Resource
win10v2004-20240226-en
General
-
Target
be4b9cd2e84c1744e29740cf78a374cc.exe
-
Size
17KB
-
MD5
be4b9cd2e84c1744e29740cf78a374cc
-
SHA1
ed35e6099897f7ac480ebc40fb68dcc75c5a52aa
-
SHA256
bc19f3977391d1ce13ab733e88333d81666ad71de7466576d8354f3e8569b269
-
SHA512
a2f035cd200c251b1992d0109159ba0c8553af457a9b96aa7e30c189efe3d23a53f1d08379f02f375ca221a9613c450df248e9f68919688023b24b0767fee42e
-
SSDEEP
384:s5wTs403c90rqxWO6UFjivzTYX9kD7qNezStCAoQ5O6m:GFVqxaUFsTf/qPZ5Fm
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run LYLOADMR.EXE -
Deletes itself 1 IoCs
pid Process 2356 LYLOADMR.EXE -
Executes dropped EXE 1 IoCs
pid Process 2356 LYLOADMR.EXE -
Loads dropped DLL 2 IoCs
pid Process 1720 be4b9cd2e84c1744e29740cf78a374cc.exe 1720 be4b9cd2e84c1744e29740cf78a374cc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\SHQMANGR.DLL LYLOADMR.EXE File created C:\Windows\SysWOW64\SHQ.DLL LYLOADMR.EXE File created C:\Windows\SysWOW64\REGKEY.hiv LYLOADMR.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2356 LYLOADMR.EXE 2356 LYLOADMR.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeRestorePrivilege 2356 LYLOADMR.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2356 1720 be4b9cd2e84c1744e29740cf78a374cc.exe 28 PID 1720 wrote to memory of 2356 1720 be4b9cd2e84c1744e29740cf78a374cc.exe 28 PID 1720 wrote to memory of 2356 1720 be4b9cd2e84c1744e29740cf78a374cc.exe 28 PID 1720 wrote to memory of 2356 1720 be4b9cd2e84c1744e29740cf78a374cc.exe 28 PID 2356 wrote to memory of 1204 2356 LYLOADMR.EXE 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\be4b9cd2e84c1744e29740cf78a374cc.exe"C:\Users\Admin\AppData\Local\Temp\be4b9cd2e84c1744e29740cf78a374cc.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\LYLOADMR.EXEC:\Users\Admin\AppData\Local\Temp\LYLOADMR.EXE "C:\Users\Admin\AppData\Local\Temp\be4b9cd2e84c1744e29740cf78a374cc.exe"3⤵
- Adds policy Run key to start application
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5f071f6d487bd5941ceb20e524412295e
SHA16ff3e2c7cd1d63cafdcbaeebbdfc6c87345aac32
SHA256e7412e454a628b775d6c521607505e57a417d9e55046675fa2fd3c077f17c837
SHA51278aeb406274fca62d4391f82ac801bef915b4c1cefb23a0c2212b9591d8fa2724916f6a9bfc8b82c89fd95b2581e0b5f1bf68841bdc06663009b7a31d67b230d