Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 01:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe
-
Size
404KB
-
MD5
0c09634a39a624868eb8367b703f5840
-
SHA1
c1bc271c4d368d67aaab452e44c6d994a95b13ff
-
SHA256
88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442
-
SHA512
6f7745bda4c3d65a313fefb6fee1992e2d6822bc37d029d98ea2dd769673587942cedd45d82f750b701c7c2e9cdb5593a0b10b7f8b2e95ceba0f654ea5bfc5a9
-
SSDEEP
6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 10 IoCs
flow pid Process 3 2768 rundll32.exe 7 2768 rundll32.exe 8 2768 rundll32.exe 9 2768 rundll32.exe 10 2768 rundll32.exe 13 2768 rundll32.exe 14 2768 rundll32.exe 15 2768 rundll32.exe 17 2768 rundll32.exe 18 2768 rundll32.exe -
Deletes itself 1 IoCs
pid Process 2556 meqpy.exe -
Executes dropped EXE 1 IoCs
pid Process 2556 meqpy.exe -
Loads dropped DLL 6 IoCs
pid Process 2736 cmd.exe 2736 cmd.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\nqtns\\towgg.dll\",Verify" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\x: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2768 rundll32.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\nqtns meqpy.exe File created \??\c:\Program Files\nqtns\towgg.dll meqpy.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2892 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe 2768 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2768 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2492 88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe 2556 meqpy.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2736 2492 88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe 28 PID 2492 wrote to memory of 2736 2492 88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe 28 PID 2492 wrote to memory of 2736 2492 88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe 28 PID 2492 wrote to memory of 2736 2492 88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe 28 PID 2736 wrote to memory of 2892 2736 cmd.exe 30 PID 2736 wrote to memory of 2892 2736 cmd.exe 30 PID 2736 wrote to memory of 2892 2736 cmd.exe 30 PID 2736 wrote to memory of 2892 2736 cmd.exe 30 PID 2736 wrote to memory of 2556 2736 cmd.exe 31 PID 2736 wrote to memory of 2556 2736 cmd.exe 31 PID 2736 wrote to memory of 2556 2736 cmd.exe 31 PID 2736 wrote to memory of 2556 2736 cmd.exe 31 PID 2556 wrote to memory of 2768 2556 meqpy.exe 32 PID 2556 wrote to memory of 2768 2556 meqpy.exe 32 PID 2556 wrote to memory of 2768 2556 meqpy.exe 32 PID 2556 wrote to memory of 2768 2556 meqpy.exe 32 PID 2556 wrote to memory of 2768 2556 meqpy.exe 32 PID 2556 wrote to memory of 2768 2556 meqpy.exe 32 PID 2556 wrote to memory of 2768 2556 meqpy.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe"C:\Users\Admin\AppData\Local\Temp\88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\meqpy.exe "C:\Users\Admin\AppData\Local\Temp\88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\meqpy.exeC:\Users\Admin\AppData\Local\Temp\\meqpy.exe "C:\Users\Admin\AppData\Local\Temp\88153865900a1ac4d3c37a7a330b0b501bafc3edb68d534b89fab7a436b8d442.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\Program Files\nqtns\towgg.dll",Verify C:\Users\Admin\AppData\Local\Temp\meqpy.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD51f768c1b506e8f3a8309489e3726e9b4
SHA1fff7216fac83e727e0c3dac5a53bc3e9f9a28c2f
SHA2568f13a257e5b0dc95762367ccc97721844abad96ac42168a630cb26ae022bfb5f
SHA5128f8101aeaa28d066824867af8e68d0331182b8165117d3b269f3f49256bfb716fa98afcb3c1b033abda4cc98dabf598d648f69faf1d9745347e3af0e3c39bacb
-
Filesize
405KB
MD578123f1ae44bb6fb4cb465610a5ab321
SHA19a88f74095892403a0b0a348b54a7d0324ace5e8
SHA256a7e29bab719c4a8361c390d83efd9c10b4e81cb76a858b6e2b49e5733a8d6d87
SHA51205b0d89ab0edecb3a74e5317f9c65abcade5ad928b0ec2666df81f7ac8195c8d2c98eb7fb6a402aa49dcb78b78c21886b51699d7a1990fc4601445e768223e80