Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 03:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe
-
Size
403KB
-
MD5
261d4a7b37ef1259131dcdd74d40656c
-
SHA1
28e6f79d0eb036f3cb775b793ef73a5651232281
-
SHA256
9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f
-
SHA512
6345acc12284014dd9522cd8073767a16d1a9ae37c929fffd251226ad6ebae93776841c7279755de93d131ac48ca7774a2375b101bd5f90cf625560a83b75463
-
SSDEEP
6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4:gtRfJcNYFNm8UhlZGse
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 10 IoCs
flow pid Process 3 2668 rundll32.exe 5 2668 rundll32.exe 8 2668 rundll32.exe 9 2668 rundll32.exe 10 2668 rundll32.exe 13 2668 rundll32.exe 14 2668 rundll32.exe 15 2668 rundll32.exe 17 2668 rundll32.exe 18 2668 rundll32.exe -
Deletes itself 1 IoCs
pid Process 2572 esozo.exe -
Executes dropped EXE 1 IoCs
pid Process 2572 esozo.exe -
Loads dropped DLL 6 IoCs
pid Process 2356 cmd.exe 2356 cmd.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\vsvjq\\lgbyr.dll\",Verify" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\l: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2668 rundll32.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\vsvjq esozo.exe File created \??\c:\Program Files\vsvjq\lgbyr.dll esozo.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1768 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe 2668 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2668 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2864 9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe 2572 esozo.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2356 2864 9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe 28 PID 2864 wrote to memory of 2356 2864 9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe 28 PID 2864 wrote to memory of 2356 2864 9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe 28 PID 2864 wrote to memory of 2356 2864 9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe 28 PID 2356 wrote to memory of 1768 2356 cmd.exe 30 PID 2356 wrote to memory of 1768 2356 cmd.exe 30 PID 2356 wrote to memory of 1768 2356 cmd.exe 30 PID 2356 wrote to memory of 1768 2356 cmd.exe 30 PID 2356 wrote to memory of 2572 2356 cmd.exe 31 PID 2356 wrote to memory of 2572 2356 cmd.exe 31 PID 2356 wrote to memory of 2572 2356 cmd.exe 31 PID 2356 wrote to memory of 2572 2356 cmd.exe 31 PID 2572 wrote to memory of 2668 2572 esozo.exe 32 PID 2572 wrote to memory of 2668 2572 esozo.exe 32 PID 2572 wrote to memory of 2668 2572 esozo.exe 32 PID 2572 wrote to memory of 2668 2572 esozo.exe 32 PID 2572 wrote to memory of 2668 2572 esozo.exe 32 PID 2572 wrote to memory of 2668 2572 esozo.exe 32 PID 2572 wrote to memory of 2668 2572 esozo.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe"C:\Users\Admin\AppData\Local\Temp\9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\esozo.exe "C:\Users\Admin\AppData\Local\Temp\9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:1768
-
-
C:\Users\Admin\AppData\Local\Temp\esozo.exeC:\Users\Admin\AppData\Local\Temp\\esozo.exe "C:\Users\Admin\AppData\Local\Temp\9aaa3808e714203de761fc2ba5cb7e69e0f14b96d2eb5d662597082b3db22c6f.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\Program Files\vsvjq\lgbyr.dll",Verify C:\Users\Admin\AppData\Local\Temp\esozo.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD5d779ab39004f561e526052ed68b8d1ea
SHA136d82f31a28a2440d12c95193f20be9e64836b27
SHA25640495c179b716e253f905b1ff29a730dbcfe4a90ad8a0a3eed0088a8992bab2b
SHA5120c12bff77b3db8ce8bddabd46840362d7b750ae22ec2efcdc0a0b7dda073951ed99e4cb1f1a23e78a2bb16dd9d2c8e614da52f9fde44d80339b534abc5f90f3d
-
Filesize
403KB
MD5bffed3a0dc281a442f0f987099679b7d
SHA1d1d719505add644236ecf5635642331fb6453fc9
SHA2562d2221f902af296b58b147bcebd010dd89a2480363bc070d1a0dff159f4edc34
SHA512572ea1a31de6a43b33b4d33143e31176b2d6a667a50fbeb5277c2797629b84e88252cd3084a39875905abef6eb420be8f346950b3905a4b9f1d9af670d534cb6