Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 01:48

General

  • Target

    b301e75b8e912087b505604a2a2f23577631d69514bad1c8223b81adc8a37911.exe

  • Size

    319KB

  • MD5

    535b9dd057abf2df643aa19e09763911

  • SHA1

    a3014dec836317a85a647de84f1607aca4f17f9b

  • SHA256

    b301e75b8e912087b505604a2a2f23577631d69514bad1c8223b81adc8a37911

  • SHA512

    ecb8357a19199fe6e5a1787bd61449b8d2c5a73f47958380beb492b0520337a44ec5044d1ed1b74cb5448d426a8b3e09f74421f072d624ccc6985c2755931a01

  • SSDEEP

    6144:oAecbuBQy7Sb0riExpMMF9yyjeEUxmLSOBMvNOzc3m/JSrSrrwZsPHItIPG:becyG+F9yynUazcW/JCM8Uot

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • UPX dump on OEP (original entry point) 21 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 17 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b301e75b8e912087b505604a2a2f23577631d69514bad1c8223b81adc8a37911.exe
    "C:\Users\Admin\AppData\Local\Temp\b301e75b8e912087b505604a2a2f23577631d69514bad1c8223b81adc8a37911.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\svhost.exe
      C:\Windows\svhost.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings.exe

    Filesize

    319KB

    MD5

    80beff019c0dbd6c9650243a7d33feca

    SHA1

    0e319e1e765bc3c03f87ed03769392ef0e3beecb

    SHA256

    c43ace9cdfd5047f5e01cdcf4f7d1055c00ad5035efd0b1530a976ccbc96361d

    SHA512

    5f97eb8642e45e120b1b7c03121acde0f0f5c6b0f7896fbb83d1ca33394a58daaa8b7e525297c4ccc17e828beefbdb9f483137f2af59e899913c7676f6e32e19

  • C:\Windows\Driver.db

    Filesize

    82B

    MD5

    c2d2dc50dca8a2bfdc8e2d59dfa5796d

    SHA1

    7a6150fc53244e28d1bcea437c0c9d276c41ccad

    SHA256

    b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960

    SHA512

    6cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4

  • C:\Windows\svhost.exe

    Filesize

    319KB

    MD5

    97f7d7b920ab17090065d82e93c0cc9d

    SHA1

    5c4949bb733d5747b6fa9b2e6529a62b708b57dc

    SHA256

    71993ee9bae4bd71a06eb5cca3d435afde65120c35a0d55c4e8a9ff11003b490

    SHA512

    fec983240ea790ac2ed008d5a72db1d9de9e84f59477c1b0e87dedeeb46b5803c94dfc1e0300b2673b4e9e72eb7419c716ca385390f0c69f38220ccfa33c64e1

  • memory/2808-2684-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-4543-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-15960-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-14895-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-13573-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-1338-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-2406-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-12509-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-3479-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-7-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-5872-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-6931-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-7997-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-9052-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-10391-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2808-11452-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2884-0-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2884-721-0x0000000003940000-0x0000000003A00000-memory.dmp

    Filesize

    768KB

  • memory/2884-710-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2884-5-0x0000000003940000-0x0000000003A00000-memory.dmp

    Filesize

    768KB