Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 01:11
Behavioral task
behavioral1
Sample
a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
General
-
Target
a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe
-
Size
435KB
-
MD5
d39c73260a157d2c296e7d264e13141f
-
SHA1
6eaab20e6ba719f88311e644064227e9b1a730f2
-
SHA256
a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece
-
SHA512
97028a63f67f07387945b2859c83524a96dc816c7b05bd714980d976305d001e011f9fb335947da071c5c440a004acd26b5f91f373c3e8fc3e21dacb7c3f80e7
-
SSDEEP
12288:q6Wq4aaE6KwyF5L0Y2D1PqLy6Wq4aaE6KwyF5LL:IthEVaPqLwthE7
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" svhost.exe -
UPX dump on OEP (original entry point) 19 IoCs
resource yara_rule behavioral2/memory/4240-0-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/files/0x001c00000001e97e-3.dat UPX behavioral2/files/0x000700000002342e-122.dat UPX behavioral2/memory/4240-778-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-1320-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-2378-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-2643-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-3437-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-4754-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-5809-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-6871-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-7932-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-8987-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-10308-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-11370-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-12426-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-13477-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-14805-0x0000000000400000-0x00000000004C2000-memory.dmp UPX behavioral2/memory/680-15863-0x0000000000400000-0x00000000004C2000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
pid Process 680 svhost.exe -
resource yara_rule behavioral2/memory/4240-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x001c00000001e97e-3.dat upx behavioral2/files/0x000700000002342e-122.dat upx behavioral2/memory/4240-778-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-1320-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-2378-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-2643-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-3437-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-4754-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-5809-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-6871-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-7932-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-8987-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-10308-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-11370-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-12426-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-13477-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-14805-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/680-15863-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: svhost.exe File opened (read-only) \??\p: svhost.exe File opened (read-only) \??\r: svhost.exe File opened (read-only) \??\v: svhost.exe File opened (read-only) \??\g: svhost.exe File opened (read-only) \??\m: svhost.exe File opened (read-only) \??\l: svhost.exe File opened (read-only) \??\t: svhost.exe File opened (read-only) \??\w: svhost.exe File opened (read-only) \??\y: svhost.exe File opened (read-only) \??\j: svhost.exe File opened (read-only) \??\k: svhost.exe File opened (read-only) \??\z: svhost.exe File opened (read-only) \??\b: svhost.exe File opened (read-only) \??\q: svhost.exe File opened (read-only) \??\h: svhost.exe File opened (read-only) \??\i: svhost.exe File opened (read-only) \??\o: svhost.exe File opened (read-only) \??\s: svhost.exe File opened (read-only) \??\u: svhost.exe File opened (read-only) \??\x: svhost.exe File opened (read-only) \??\a: svhost.exe File opened (read-only) \??\e: svhost.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4240-778-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-1320-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-2378-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-2643-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-3437-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-4754-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-5809-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-6871-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-7932-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-8987-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-10308-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-11370-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-12426-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-13477-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-14805-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/680-15863-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svhost.exe a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe File opened for modification C:\Windows\Driver.db svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 680 svhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe 680 svhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4240 wrote to memory of 680 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 85 PID 4240 wrote to memory of 680 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 85 PID 4240 wrote to memory of 680 4240 a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe"C:\Users\Admin\AppData\Local\Temp\a03613764f6ab5c2e7bd44e9c020f612eae0733f7a7e8ee7bbfdc12798df9ece.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
435KB
MD5f7d6a4222cd130dd315c592d9864d4dd
SHA144b0d9c8223e7294b783b08f4a75228ef9a65d2e
SHA2567df91ec5502a195173a1087dc5dbf4457fcf4527f8eed9b6cd5253af8d3d26e1
SHA5126269a3decb6aa87b248ecab65772d0a99b29f011effb6d306e778462e4543eba05e93c9fa286bfea055e80ebdba3642d75df03fc038957537131a280287146cf
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
435KB
MD52e8853758f341f1c47c6354f4fb5744b
SHA1d872aec5212741e77a951a4246759e922aeb7557
SHA256367aa0524193090543e37379fd6ca036c250c9ccfa75e68493e847836587d66b
SHA512f6a3f5de92d4412ba9c79a677e890700b4ba6480ae6d0e02533f422fefbed3264d41c10e6f822fc3debe7a577e3530c3f39a3e232fb59f681d9324703efa8e86