Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 23:21
Static task
static1
Behavioral task
behavioral1
Sample
6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c.exe
Resource
win10v2004-20240226-en
General
-
Target
6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c.exe
-
Size
29KB
-
MD5
3a283c003f312fd8db84954774b524f9
-
SHA1
64561b603809d1311258d3d17736848b70a398ce
-
SHA256
6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c
-
SHA512
04ade9495d68f0e5f8b6735ad1985cfaf640f6332c684239b72c7b87a39b5e42f73861695d995a1267325c6c851d9b2b1d0f00bfb546ed367de78d0d7cfa56ca
-
SSDEEP
768:/qPJtEA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfh7cAT:/qkA6C1VqaqhtgVRNToV7TtRu8rM0wYt
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2016 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 2016 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2016 2232 6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c.exe 28 PID 2232 wrote to memory of 2016 2232 6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c.exe 28 PID 2232 wrote to memory of 2016 2232 6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c.exe 28 PID 2232 wrote to memory of 2016 2232 6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c.exe"C:\Users\Admin\AppData\Local\Temp\6318e83526d61de97698062e2e39267f9079072d9e181af668274b33c329b98c.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:2016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD53270b8bc55ad374c082d86ebe1c49080
SHA19e11a3ef26137c8d6796ed70fc447c6eff5906d0
SHA256bdc26f6538e917eafeba6fc0748cb678641012d4d33664b6cbbc00670bfdc5a5
SHA512dd58cf37427fbb13da2272f622fd6e4e81c91281770aeb6a48772fc1489df054ddf8683b364b3b2d928e1b29c065709c3738dca88c7bca8ef8af85d4b6efd37a