Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe
Resource
win7-20240221-en
General
-
Target
06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe
-
Size
134KB
-
MD5
28cea1d9184634d41849ecbfc7021883
-
SHA1
531e1918182b09088e1433c1f29b91c93181ef4a
-
SHA256
06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce
-
SHA512
48f4171df816e51a37cd3567d914ceefcc1be8acd14825c988100d2af3803c9403732af04fbeea54d9c8b27702fce9d8b9874c0907e58cad3fdf85f0d8406121
-
SSDEEP
1536:cDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:CiRTeH0iqAW6J6f1tqF6dngNmaZCia
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Detects executables built or packed with MPress PE compressor 11 IoCs
resource yara_rule behavioral1/memory/2772-0-0x0000000000400000-0x0000000000424000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x0009000000015c23-12.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/2932-23-0x0000000000400000-0x0000000000424000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2772-7-0x0000000000400000-0x0000000000424000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/2932-33-0x0000000000400000-0x0000000000424000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x001000000000f680-45.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/2516-46-0x0000000002160000-0x0000000002184000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/files/0x0009000000015c23-67.dat INDICATOR_EXE_Packed_MPress behavioral1/memory/1976-63-0x0000000000400000-0x0000000000424000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/1600-77-0x0000000000400000-0x0000000000424000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral1/memory/1600-84-0x0000000000400000-0x0000000000424000-memory.dmp INDICATOR_EXE_Packed_MPress -
Executes dropped EXE 6 IoCs
pid Process 2932 omsecor.exe 2516 omsecor.exe 1976 omsecor.exe 1296 omsecor.exe 1600 omsecor.exe 1772 omsecor.exe -
Loads dropped DLL 7 IoCs
pid Process 2940 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 2940 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 2932 omsecor.exe 2516 omsecor.exe 2516 omsecor.exe 1296 omsecor.exe 1296 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2772 set thread context of 2940 2772 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 28 PID 2932 set thread context of 2516 2932 omsecor.exe 30 PID 1976 set thread context of 1296 1976 omsecor.exe 35 PID 1600 set thread context of 1772 1600 omsecor.exe 37 -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2940 2772 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 28 PID 2772 wrote to memory of 2940 2772 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 28 PID 2772 wrote to memory of 2940 2772 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 28 PID 2772 wrote to memory of 2940 2772 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 28 PID 2772 wrote to memory of 2940 2772 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 28 PID 2772 wrote to memory of 2940 2772 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 28 PID 2940 wrote to memory of 2932 2940 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 29 PID 2940 wrote to memory of 2932 2940 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 29 PID 2940 wrote to memory of 2932 2940 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 29 PID 2940 wrote to memory of 2932 2940 06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe 29 PID 2932 wrote to memory of 2516 2932 omsecor.exe 30 PID 2932 wrote to memory of 2516 2932 omsecor.exe 30 PID 2932 wrote to memory of 2516 2932 omsecor.exe 30 PID 2932 wrote to memory of 2516 2932 omsecor.exe 30 PID 2932 wrote to memory of 2516 2932 omsecor.exe 30 PID 2932 wrote to memory of 2516 2932 omsecor.exe 30 PID 2516 wrote to memory of 1976 2516 omsecor.exe 34 PID 2516 wrote to memory of 1976 2516 omsecor.exe 34 PID 2516 wrote to memory of 1976 2516 omsecor.exe 34 PID 2516 wrote to memory of 1976 2516 omsecor.exe 34 PID 1976 wrote to memory of 1296 1976 omsecor.exe 35 PID 1976 wrote to memory of 1296 1976 omsecor.exe 35 PID 1976 wrote to memory of 1296 1976 omsecor.exe 35 PID 1976 wrote to memory of 1296 1976 omsecor.exe 35 PID 1976 wrote to memory of 1296 1976 omsecor.exe 35 PID 1976 wrote to memory of 1296 1976 omsecor.exe 35 PID 1296 wrote to memory of 1600 1296 omsecor.exe 36 PID 1296 wrote to memory of 1600 1296 omsecor.exe 36 PID 1296 wrote to memory of 1600 1296 omsecor.exe 36 PID 1296 wrote to memory of 1600 1296 omsecor.exe 36 PID 1600 wrote to memory of 1772 1600 omsecor.exe 37 PID 1600 wrote to memory of 1772 1600 omsecor.exe 37 PID 1600 wrote to memory of 1772 1600 omsecor.exe 37 PID 1600 wrote to memory of 1772 1600 omsecor.exe 37 PID 1600 wrote to memory of 1772 1600 omsecor.exe 37 PID 1600 wrote to memory of 1772 1600 omsecor.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe"C:\Users\Admin\AppData\Local\Temp\06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exeC:\Users\Admin\AppData\Local\Temp\06a68b7098c5cb014aa3ad279abc256c6037e2a827f64ae184e5719010f0abce.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\SysWOW64\omsecor.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe8⤵
- Executes dropped EXE
PID:1772
-
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD50f66386e6876ec047b7cc216b0a3b364
SHA1a574cfa6991f7ba03ad822df7672843a4d8f5846
SHA256f32c3b4bc9ee526134ca803852718a63e46e56b95c5084707e4d7cb04f1a4f27
SHA512ecca793944bdb7b19503b1bf8934175415f1dc3beb49f76b3d3f4beee8ab527d2aff8973fccdf4613acbdc4d32ea2342c0ccff5ccf20428a9928a5e4443865ec
-
Filesize
134KB
MD510f72e08525ac573764be8b51c850142
SHA169944ac0eecd08349e98091185ea9f3d6bf0bae0
SHA256a7daacfa9c8cacb39d01f3b0484b4d3a5b28563b5afe669ba0feed38f1a0f9f4
SHA512d5ef9158fe4786de121439c37b074f0c63260e723264a90153099dcf49479f314a4235c14380af72cf015d55b9a7a30f1ca6dc12603561e7eda28a8071f87b38
-
Filesize
134KB
MD51664239f58a07261b7945761d22f7c4d
SHA1eac87d3793c164c0d3d97905b823134ade6f03ea
SHA256867525fd43ad1ee67fc3813a4b25dee48a4bdc64f990717e977ce3bfe73e0dee
SHA512f0145a93202711dec703637b31e0bca4623d9584d11d787e1a2eaf8d521de8092f23c75ca6840ff2a9836726f44b90dbe1982a8d4c595597f3ecad36e9942524