Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 23:01
Static task
static1
Behavioral task
behavioral1
Sample
c1d3eba84431214902d4c562999317e8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c1d3eba84431214902d4c562999317e8.exe
Resource
win10v2004-20240226-en
General
-
Target
c1d3eba84431214902d4c562999317e8.exe
-
Size
315KB
-
MD5
c1d3eba84431214902d4c562999317e8
-
SHA1
888506300aebcd27ff1f4c60cd4cbbc2da7006cc
-
SHA256
03840f3e790cc87054fb2cedbe9599ea8ecd5627a845e31ec80ac09d6b279e3f
-
SHA512
55756420c0ac77ace4aa81add45a89197ae10504d09810a0512c391af57a6b11bddd6ab8fa321e9a9a22dd5ba3cae48f64fc96710a95b8ce6c374f8d62ecc1e8
-
SSDEEP
6144:j/m6Mh9mPutuTST7yiza7inj1VwPq3BnZGrM60IcEemaF0utMa:S69usromqRZG90IAQa
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2996 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2444 frepq.exe -
Loads dropped DLL 3 IoCs
pid Process 2996 cmd.exe 2996 cmd.exe 2444 frepq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2564 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2532 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2564 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe 2444 frepq.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2996 2972 c1d3eba84431214902d4c562999317e8.exe 28 PID 2972 wrote to memory of 2996 2972 c1d3eba84431214902d4c562999317e8.exe 28 PID 2972 wrote to memory of 2996 2972 c1d3eba84431214902d4c562999317e8.exe 28 PID 2972 wrote to memory of 2996 2972 c1d3eba84431214902d4c562999317e8.exe 28 PID 2996 wrote to memory of 2564 2996 cmd.exe 30 PID 2996 wrote to memory of 2564 2996 cmd.exe 30 PID 2996 wrote to memory of 2564 2996 cmd.exe 30 PID 2996 wrote to memory of 2564 2996 cmd.exe 30 PID 2996 wrote to memory of 2532 2996 cmd.exe 32 PID 2996 wrote to memory of 2532 2996 cmd.exe 32 PID 2996 wrote to memory of 2532 2996 cmd.exe 32 PID 2996 wrote to memory of 2532 2996 cmd.exe 32 PID 2996 wrote to memory of 2444 2996 cmd.exe 33 PID 2996 wrote to memory of 2444 2996 cmd.exe 33 PID 2996 wrote to memory of 2444 2996 cmd.exe 33 PID 2996 wrote to memory of 2444 2996 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1d3eba84431214902d4c562999317e8.exe"C:\Users\Admin\AppData\Local\Temp\c1d3eba84431214902d4c562999317e8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2972 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\c1d3eba84431214902d4c562999317e8.exe" & start C:\Users\Admin\AppData\Local\frepq.exe -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 29723⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2532
-
-
C:\Users\Admin\AppData\Local\frepq.exeC:\Users\Admin\AppData\Local\frepq.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2444
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
315KB
MD5c1d3eba84431214902d4c562999317e8
SHA1888506300aebcd27ff1f4c60cd4cbbc2da7006cc
SHA25603840f3e790cc87054fb2cedbe9599ea8ecd5627a845e31ec80ac09d6b279e3f
SHA51255756420c0ac77ace4aa81add45a89197ae10504d09810a0512c391af57a6b11bddd6ab8fa321e9a9a22dd5ba3cae48f64fc96710a95b8ce6c374f8d62ecc1e8