Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
c87de593d0dbc26df38f8af93c65cc36.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c87de593d0dbc26df38f8af93c65cc36.exe
Resource
win10v2004-20231215-en
General
-
Target
c87de593d0dbc26df38f8af93c65cc36.exe
-
Size
38KB
-
MD5
c87de593d0dbc26df38f8af93c65cc36
-
SHA1
b6bb1d606b741b28bd95346902ec3441ae4d58d6
-
SHA256
c1a55ed664f378c12560c5992b557edb675417bd4b28fc91e7927ac24e3376e6
-
SHA512
c1ebaad2e12292a0ee5a41c88e041dd7f41c774627dd55dd9193e2424507ca03daaefb198be932552574c6ba61c7d60e966fb4d2f6896138044cc2600192d573
-
SSDEEP
768:YU5ChYknJSDX474YqS2Ir2iZlaNdCLCCHqDHiabUOHcaUD1Vcopm:YUsJnsM74FSPTZlaWCCHiCabUO8nD1R4
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2372 netsh.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Windows\\system32\\wind32.exe" c87de593d0dbc26df38f8af93c65cc36.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\dllgh8jkd1q8.exe c87de593d0dbc26df38f8af93c65cc36.exe File opened for modification C:\Windows\SysWOW64\dllgh8jkd1q8.exe c87de593d0dbc26df38f8af93c65cc36.exe File created C:\Windows\SysWOW64\wind32.exe c87de593d0dbc26df38f8af93c65cc36.exe File opened for modification C:\Windows\SysWOW64\wind32.exe c87de593d0dbc26df38f8af93c65cc36.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2940 2368 WerFault.exe 27 -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2368 c87de593d0dbc26df38f8af93c65cc36.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2372 2368 c87de593d0dbc26df38f8af93c65cc36.exe 28 PID 2368 wrote to memory of 2372 2368 c87de593d0dbc26df38f8af93c65cc36.exe 28 PID 2368 wrote to memory of 2372 2368 c87de593d0dbc26df38f8af93c65cc36.exe 28 PID 2368 wrote to memory of 2372 2368 c87de593d0dbc26df38f8af93c65cc36.exe 28 PID 2368 wrote to memory of 2940 2368 c87de593d0dbc26df38f8af93c65cc36.exe 32 PID 2368 wrote to memory of 2940 2368 c87de593d0dbc26df38f8af93c65cc36.exe 32 PID 2368 wrote to memory of 2940 2368 c87de593d0dbc26df38f8af93c65cc36.exe 32 PID 2368 wrote to memory of 2940 2368 c87de593d0dbc26df38f8af93c65cc36.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c87de593d0dbc26df38f8af93c65cc36.exe"C:\Users\Admin\AppData\Local\Temp\c87de593d0dbc26df38f8af93c65cc36.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\netsh.exenetsh firewall set allowedprogram 'C:\Users\Admin\AppData\Local\Temp\c87de593d0dbc26df38f8af93c65cc36.exe' enable2⤵
- Modifies Windows Firewall
PID:2372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 8242⤵
- Program crash
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d268040aeda1b8e89694151c3859b7c1
SHA185a66553924374b7a42e96c167dc3895f8c8e2b1
SHA256ecbb361c1075daac111beae16c3fe2675623235c42183a4db536095b41226b99
SHA51233e7fa61ca3a792366ed6442c5a3297c59c0f5cc1fec03d8c5abeb9294035b89c4bf51d9e204b02ce7d7912b8a6a7b5bdc7905e63343f30b9e72fd02979b30e7