Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/04/2024, 18:22
Static task
static1
Behavioral task
behavioral1
Sample
08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe
Resource
win10v2004-20240226-en
General
-
Target
08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe
-
Size
61KB
-
MD5
e2f1357f3ac3b2cd335104e725f2dca3
-
SHA1
86f97f76d24b9f70c8edee70185d1ab7886db2eb
-
SHA256
08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e
-
SHA512
755eacb03df3d0ce9b17ef16df26daaf5750f07d27f33edcb99f3ca3c4be14aca67117c1a894fde0d4324e224d9e81719c0c9fbd2862376febca09cea2f0d114
-
SSDEEP
1536:NDj2d6rnJbJnJBSX1nV1b1N1Il1k1YFI1x1J1MuEqx517Q/1T1Jzct01Nsqnl1RE:FlnnJBSX1nV1b1N1Il1k1YFI1x1J1MuD
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1732 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 1732 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1732 microsofthelp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 1732 1936 08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe 28 PID 1936 wrote to memory of 1732 1936 08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe 28 PID 1936 wrote to memory of 1732 1936 08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe 28 PID 1936 wrote to memory of 1732 1936 08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe"C:\Users\Admin\AppData\Local\Temp\08353cc8f2b15c9ad6a1781b9905ad7a354cf33d0db3f076fd4acc47d583328e.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5959affcda29e008b757efbf6a3422687
SHA18abf02c9b094b20e4d86a882a8b75d66af2a64c0
SHA256ff00a841055389e867153f99d0fa1c28c401a9250eca63b60ef58917d00a127b
SHA512ffb1d606ec6dd37a62e010e0c2d8c434cc674c7cf691efe3ab69d42a3d373372d69ac90c4978cd84682b09b7f7db3ec7ce40e93a684e07edd31f802c2154fc4e