Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/04/2024, 12:45
240417-py47wsff45 1017/04/2024, 12:45
240417-py3n3ahb5z 1017/04/2024, 12:45
240417-py23jahb5x 1017/04/2024, 12:44
240417-pyxg2sff35 1017/04/2024, 12:44
240417-pyw7aaff33 1017/04/2024, 06:12
240417-gynk5sff65 10Analysis
-
max time kernel
1799s -
max time network
1568s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe
Resource
win11-20240412-en
General
-
Target
382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe
-
Size
84KB
-
MD5
eeaeb64b80465d155e7c53858de7761c
-
SHA1
5c1e8a6783c4db3e331103e86dd4383ed1a8286f
-
SHA256
382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd
-
SHA512
f69885e932515cbdf94556fe19f447fc5b530f41eed64e12bf7efcfb3761ef15a1d3e88248ae4aa288bef25cd70b3a88611e2671e21ae64da3d78fc6f4bed188
-
SSDEEP
1536:Gh/3/Qo5qRJvMo23MPM8MDyR1CaVHob64SPy6bgMuqDqkyJcFh:Gh/Xj4R1RVHoWrbfuaqk/F
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" audiodg.exe -
Executes dropped EXE 1 IoCs
pid Process 2724 audiodg.exe -
Loads dropped DLL 1 IoCs
pid Process 1924 382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" audiodg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" audiodg.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Audio Device Graph Isolation = "C:\\30701146433628\\audiodg.exe" 382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Audio Device Graph Isolation = "C:\\30701146433628\\audiodg.exe" 382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2724 1924 382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe 29 PID 1924 wrote to memory of 2724 1924 382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe 29 PID 1924 wrote to memory of 2724 1924 382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe 29 PID 1924 wrote to memory of 2724 1924 382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe"C:\Users\Admin\AppData\Local\Temp\382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\30701146433628\audiodg.exeC:\30701146433628\audiodg.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5eeaeb64b80465d155e7c53858de7761c
SHA15c1e8a6783c4db3e331103e86dd4383ed1a8286f
SHA256382b038933967bfee1428ec297736226045b1acafce0bf6b9bd7f1c2fee348bd
SHA512f69885e932515cbdf94556fe19f447fc5b530f41eed64e12bf7efcfb3761ef15a1d3e88248ae4aa288bef25cd70b3a88611e2671e21ae64da3d78fc6f4bed188