Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1.exe
Resource
win10v2004-20240412-en
General
-
Target
611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1.exe
-
Size
72KB
-
MD5
6b4271b45f74c069dd14b56f15ee6ca8
-
SHA1
71ad403e4380bee8bc204eae9876d933012b601b
-
SHA256
611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1
-
SHA512
d7ffbdd8f4a096dfed4cbc68c173a2b0ae7653de41f127fddb2c9b420b2764f7463d2b24528bf55c8c17801151d72c50e4053ea436b40d1638f1535c0887399c
-
SSDEEP
1536:NDj2d6rnJbJnJBSX1nV1b1N1Il1k1YFI1x1J1MuEqx517Q/1T1Jzct01Nsqnl1Ru:FlnnJBSX1nV1b1N1Il1k1YFI1x1J1MuF
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2940 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 2940 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\HidePlugin.dll microsofthelp.exe File created C:\Windows\microsofthelp.exe 611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2940 microsofthelp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2940 1888 611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1.exe 28 PID 1888 wrote to memory of 2940 1888 611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1.exe 28 PID 1888 wrote to memory of 2940 1888 611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1.exe 28 PID 1888 wrote to memory of 2940 1888 611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1.exe"C:\Users\Admin\AppData\Local\Temp\611fb4646d5f227808bca5826b2255d985297c9c490e2d2107b7b66839b6c9e1.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5686972107a58563a40146f53e464e9a7
SHA1c8661619502f20e2ffba6a51af07888784281eb0
SHA2569d5b390ef9cb7beb7c8ff64353a0a86bdbb5f20e50684195eea7167872da1d57
SHA51289e372f91e60bf22a17bc491b268cec5ef2b5361984f38b6b98a32b9df8be5786c5bfac8a20a2961e11c3b0bcbcac441b462064c468e619eb9170f23b2f9214e