Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 21:43
Behavioral task
behavioral1
Sample
52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe
Resource
win7-20240221-en
General
-
Target
52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe
-
Size
72KB
-
MD5
494272cda145356436ad683657c83908
-
SHA1
59bbd25db1bf0c0ee790905254b46ef642285adf
-
SHA256
52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1
-
SHA512
bbb993eeb9dd60737d46e0bbfd7ab804194888ca301e02606304aae7e01624701b5a3006ad1d660b438c8966db66e8984e9d4ae287ac8b9d3a2564c6eceade9f
-
SSDEEP
1536:5d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5211:ZdseIOMEZEyFjEOFqTiQm5l/5211
Malware Config
Extracted
neconyd
http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2064 omsecor.exe 2804 omsecor.exe 2824 omsecor.exe -
Loads dropped DLL 6 IoCs
pid Process 1940 52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe 1940 52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe 2064 omsecor.exe 2064 omsecor.exe 2804 omsecor.exe 2804 omsecor.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\omsecor.exe omsecor.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2064 1940 52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe 28 PID 1940 wrote to memory of 2064 1940 52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe 28 PID 1940 wrote to memory of 2064 1940 52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe 28 PID 1940 wrote to memory of 2064 1940 52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe 28 PID 2064 wrote to memory of 2804 2064 omsecor.exe 32 PID 2064 wrote to memory of 2804 2064 omsecor.exe 32 PID 2064 wrote to memory of 2804 2064 omsecor.exe 32 PID 2064 wrote to memory of 2804 2064 omsecor.exe 32 PID 2804 wrote to memory of 2824 2804 omsecor.exe 33 PID 2804 wrote to memory of 2824 2804 omsecor.exe 33 PID 2804 wrote to memory of 2824 2804 omsecor.exe 33 PID 2804 wrote to memory of 2824 2804 omsecor.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe"C:\Users\Admin\AppData\Local\Temp\52ab5c2e6c1c6fe1fcef8345151a0672cd921dacd247d8fa52f6b829ce82f5f1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
PID:2824
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD573ba94eac2bf65978b142ed2e57d3f39
SHA142e1018b8c3c3b6c56e7558949e9f2c29fe700e0
SHA256678cdf90519de4b857dcee3116828def3100591c8f47bbdc839d029a3a0b10c4
SHA51285aa213949426373f9d8eb4a0574ddd94cffb70d2cd2c79214f389db325995052d07e211dac3967ecfd5f42a492f2c7174389997fb1934606c72e86444b3b3aa
-
Filesize
72KB
MD56357c338150c09fc71642f8c18d0ad59
SHA129c054846b593bc2cd7ae68815fe029a2bb02d24
SHA2561e58fb221b40865af362433d52734197500d1d01761cffd5a3d8f8d05f1a7851
SHA5128047c39ca9ab973ec821ea7666f6d50e05bd0b990ea00b6f709673156b00c5f43057aa38071c87cc2fa5242c3cef6b94a832043dd600a4bb7997def6c31bd18e
-
Filesize
72KB
MD5da43c049f54e60991543230c1aaa6132
SHA1572688e5bfddf4c80f9ee7113088b194b4085cc0
SHA256c1ac3040c342743bd21490ac747e1ad8dae3ade048dee5ea0bbb2f53b3909884
SHA5121883985e3dc006a6ea919b258bef65acf6c91af8b7dbabb6a6e766fd2641ba55675afa668777501658a637f5536271933fef57f7ac97520147f90f0d10460e7b