Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 03:38
Static task
static1
Behavioral task
behavioral1
Sample
b185ee1d0e238b92148737f4a760c681.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b185ee1d0e238b92148737f4a760c681.exe
Resource
win10v2004-20240226-en
General
-
Target
b185ee1d0e238b92148737f4a760c681.exe
-
Size
344KB
-
MD5
b185ee1d0e238b92148737f4a760c681
-
SHA1
c99f6e20909a78cf70384dd6df4fa6591632b2e0
-
SHA256
c5f8f6569fac20e7f0f94c7c717cf20949cb06d256ac2447aa4eef1f9ab4bfca
-
SHA512
20e144a638687638eda9b80d4ff649e7824cc657bed671dac679af37dcb6e33c07715edf691b10e3bd5c1b2d895fd9459afe67d82eb0f0b3f7b0bfb93de8f27d
-
SSDEEP
6144:DTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDBRm1+gmN:DTBPFV0RyWl3h2E+7pYm0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2716 dwmsys.exe 2684 dwmsys.exe -
Loads dropped DLL 4 IoCs
pid Process 2620 b185ee1d0e238b92148737f4a760c681.exe 2620 b185ee1d0e238b92148737f4a760c681.exe 2620 b185ee1d0e238b92148737f4a760c681.exe 2716 dwmsys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\DefaultIcon b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\DefaultIcon\ = "%1" b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\Content-Type = "application/x-msdownload" b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\DefaultIcon b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\shell\open\command b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\shell\open\command\IsolatedCommand = "\"%1\" %*" b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\shell\runas\command b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\shell\open b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\shell\runas b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\shell\runas\command\ = "\"%1\" %*" b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\shell\runas b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\DefaultIcon\ = "%1" b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\shell b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\dwmsys.exe\" /START \"%1\" %*" b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\shell\open b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\shell\runas\command b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_amd64\\dwmsys.exe\" /START \"%1\" %*" b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\ = "Application" b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\systemui\shell\runas\command\IsolatedCommand = "\"%1\" %*" b185ee1d0e238b92148737f4a760c681.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\ = "systemui" b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\shell\open\command b185ee1d0e238b92148737f4a760c681.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.exe\shell b185ee1d0e238b92148737f4a760c681.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2716 dwmsys.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2716 2620 b185ee1d0e238b92148737f4a760c681.exe 28 PID 2620 wrote to memory of 2716 2620 b185ee1d0e238b92148737f4a760c681.exe 28 PID 2620 wrote to memory of 2716 2620 b185ee1d0e238b92148737f4a760c681.exe 28 PID 2620 wrote to memory of 2716 2620 b185ee1d0e238b92148737f4a760c681.exe 28 PID 2716 wrote to memory of 2684 2716 dwmsys.exe 29 PID 2716 wrote to memory of 2684 2716 dwmsys.exe 29 PID 2716 wrote to memory of 2684 2716 dwmsys.exe 29 PID 2716 wrote to memory of 2684 2716 dwmsys.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b185ee1d0e238b92148737f4a760c681.exe"C:\Users\Admin\AppData\Local\Temp\b185ee1d0e238b92148737f4a760c681.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_amd64\dwmsys.exe"3⤵
- Executes dropped EXE
PID:2684
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5ba6b3e9e7fb1285f73d5afde9acf1b31
SHA147670254c1e8843ab4f57c03863e55ef2956490b
SHA256484f5e3b627132e8df56b72dd2014b909105674cc4b53a72afe2cd9f2afe17f1
SHA5127342ae9cf0672865f81835fa4a7c208b8d8bdcfbb6640b58417cb8a6b618cad6fda9e3ca9a909eb670e1bb63258f0a7e51b3be33745b02f8f1a9ec202089772c