Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 23:11

General

  • Target

    c9df0a6912fdd5a6dc0164127419a356.exe

  • Size

    51KB

  • MD5

    c9df0a6912fdd5a6dc0164127419a356

  • SHA1

    3ddd186b7ac1bc7235145dcabada0b7f5430ea1d

  • SHA256

    9ed78c6d526cada01a9173984fb579b508ed75497a0fcf9c9bf1d7eea7cc128e

  • SHA512

    642420b301d2e960abc948bcad85f616df2ac40799f3348141bd28db6bf70005ad22c0adb4e256e28d3f291cd43579f6b8c2cbf5d58ddabb7a49b6fcc17003f4

  • SSDEEP

    768:81q4iZX3qdgbwEgKpUNrUrBW+RkceFKOu/E89jsUKbUQs0rZ1z2t5T1Bqu1KvGtY:84lZigbwEhl3RdUU1ajr+tB1f4Gtb+N

Score
10/10

Malware Config

Signatures

  • Windows security bypass 2 TTPs 3 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Windows security modification 2 TTPs 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies Control Panel 3 IoCs
  • Runs net.exe
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9df0a6912fdd5a6dc0164127419a356.exe
    "C:\Users\Admin\AppData\Local\Temp\c9df0a6912fdd5a6dc0164127419a356.exe"
    1⤵
    • Windows security bypass
    • Disables RegEdit via registry modification
    • Windows security modification
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /s C:\Windows\iehost.dll
      2⤵
        PID:1912
      • C:\Windows\SysWOW64\net.exe
        C:\Windows\system32\net.exe stop "Security Center"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2252
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "Security Center"
          3⤵
            PID:2332

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\iehost.dll

        Filesize

        19KB

        MD5

        c994684511f5bb0220adc6f5f533e7ab

        SHA1

        504d19223b3fd86c282867f0283dd19b3cc2bda5

        SHA256

        6858a1253169c034b83f3844dc4152ab8bee6a94840cf6366556baf11972ebfb

        SHA512

        4ce2777f926392d83ec4512bfeca6e78b5a1667072ed4cea6edeb8439ee5da7963599994365ccd3350534c2d0efc8afcc049242776011f5f6811d8a8fa70e226

      • memory/1912-6-0x0000000010000000-0x0000000010008000-memory.dmp

        Filesize

        32KB

      • memory/1912-7-0x0000000000130000-0x0000000000136000-memory.dmp

        Filesize

        24KB

      • memory/2188-0-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/2188-1-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/2188-3-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/2188-2-0x00000000003C0000-0x00000000003CC000-memory.dmp

        Filesize

        48KB

      • memory/2188-8-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB