Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
8s -
max time network
12s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 19:03
Behavioral task
behavioral1
Sample
dfe148f6d2caea2150dfc967d6d295a6.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
dfe148f6d2caea2150dfc967d6d295a6.exe
Resource
win10v2004-20240226-en
Errors
General
-
Target
dfe148f6d2caea2150dfc967d6d295a6.exe
-
Size
537KB
-
MD5
dfe148f6d2caea2150dfc967d6d295a6
-
SHA1
98a9446a04843e8281e6be98cf3e56c725401b7d
-
SHA256
d15ec2a9cbc43808cb54d1216cd1b766a9f4af1b2584a0978de26e2e25502d57
-
SHA512
4846671f0788b2eb52a7be88d27e454473a6fb18d89b4bd881a627a5b8a726d875312917b710a90d5a4eeb1bf45bda6596956504dd5332ce23e1f779dddccfe3
-
SSDEEP
12288:x068wekhxY41Nmqc8SZm4GO6KoOUmX63GEfhYFkUHsFatTRRfHu1U9XgWNyC3V:d85khxxNO5m4GhK5UNOZHfN5u4lt
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\gog.exe" dfe148f6d2caea2150dfc967d6d295a6.exe -
resource yara_rule behavioral1/memory/1656-0-0x0000000000400000-0x000000000058C000-memory.dmp upx behavioral1/memory/1656-5-0x0000000000400000-0x000000000058C000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 dfe148f6d2caea2150dfc967d6d295a6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum dfe148f6d2caea2150dfc967d6d295a6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1656 dfe148f6d2caea2150dfc967d6d295a6.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1656 dfe148f6d2caea2150dfc967d6d295a6.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1656 dfe148f6d2caea2150dfc967d6d295a6.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1656 dfe148f6d2caea2150dfc967d6d295a6.exe 1656 dfe148f6d2caea2150dfc967d6d295a6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfe148f6d2caea2150dfc967d6d295a6.exe"C:\Users\Admin\AppData\Local\Temp\dfe148f6d2caea2150dfc967d6d295a6.exe"1⤵
- Modifies WinLogon for persistence
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1656
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2612
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2260