Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 04:23
Static task
static1
Behavioral task
behavioral1
Sample
ca7b019c16cb2bdd1738ebab07144f23.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ca7b019c16cb2bdd1738ebab07144f23.exe
Resource
win10v2004-20240226-en
General
-
Target
ca7b019c16cb2bdd1738ebab07144f23.exe
-
Size
439KB
-
MD5
ca7b019c16cb2bdd1738ebab07144f23
-
SHA1
18ae4fd6b5de20f5f70f275a9f74f5c16c542f86
-
SHA256
3ece7f922f388fdbda9fcd8744a9899818a645a7e64392301e2819337389605b
-
SHA512
7ad3b08354a5a65dc5f207645bd3befc5235407b3f34793659807d2a5412ab366657603c1e60b8623466abd4028712686ebc6e93a2aaf9e3ac6476cc3f53d36a
-
SSDEEP
6144:wLOpoqwEuqiOKAzT/dcYcOGo5NvQQWkRFrO9zTNDEVscxuE3TnN+AtJkZbVNTBnp:wypoD9AnKYxbNWk3ruh0sgHnNTtcVtf
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2432 iI06511DpNaK06511.exe -
Executes dropped EXE 1 IoCs
pid Process 2432 iI06511DpNaK06511.exe -
Loads dropped DLL 2 IoCs
pid Process 460 ca7b019c16cb2bdd1738ebab07144f23.exe 460 ca7b019c16cb2bdd1738ebab07144f23.exe -
resource yara_rule behavioral1/memory/460-1-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/460-17-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2432-29-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral1/memory/2432-39-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\iI06511DpNaK06511 = "C:\\ProgramData\\iI06511DpNaK06511\\iI06511DpNaK06511.exe" iI06511DpNaK06511.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main iI06511DpNaK06511.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 460 ca7b019c16cb2bdd1738ebab07144f23.exe 460 ca7b019c16cb2bdd1738ebab07144f23.exe 460 ca7b019c16cb2bdd1738ebab07144f23.exe 460 ca7b019c16cb2bdd1738ebab07144f23.exe 460 ca7b019c16cb2bdd1738ebab07144f23.exe 460 ca7b019c16cb2bdd1738ebab07144f23.exe 460 ca7b019c16cb2bdd1738ebab07144f23.exe 460 ca7b019c16cb2bdd1738ebab07144f23.exe 460 ca7b019c16cb2bdd1738ebab07144f23.exe 460 ca7b019c16cb2bdd1738ebab07144f23.exe 460 ca7b019c16cb2bdd1738ebab07144f23.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 460 ca7b019c16cb2bdd1738ebab07144f23.exe Token: SeDebugPrivilege 2432 iI06511DpNaK06511.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2432 iI06511DpNaK06511.exe 2432 iI06511DpNaK06511.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 460 wrote to memory of 2432 460 ca7b019c16cb2bdd1738ebab07144f23.exe 28 PID 460 wrote to memory of 2432 460 ca7b019c16cb2bdd1738ebab07144f23.exe 28 PID 460 wrote to memory of 2432 460 ca7b019c16cb2bdd1738ebab07144f23.exe 28 PID 460 wrote to memory of 2432 460 ca7b019c16cb2bdd1738ebab07144f23.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca7b019c16cb2bdd1738ebab07144f23.exe"C:\Users\Admin\AppData\Local\Temp\ca7b019c16cb2bdd1738ebab07144f23.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460 -
C:\ProgramData\iI06511DpNaK06511\iI06511DpNaK06511.exe"C:\ProgramData\iI06511DpNaK06511\iI06511DpNaK06511.exe" "C:\Users\Admin\AppData\Local\Temp\ca7b019c16cb2bdd1738ebab07144f23.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
439KB
MD5eefef6a91222a5d5dcce442191a3dab8
SHA14b8288938232fdb71ecec069d405257afd26e67f
SHA2560f6a5f30afcf5b378ad4cd911698a3b31a253ff4531d8f48c7dcd8d9d342dca9
SHA51294ba46ef6c54bf2d08c821e3df3e998fcd64f9ad6e483317530d49f7db0db8990ba9eb25b6328b4229539e96a0c7abefaa7fd076214a1b988ceebb354483a987