Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe
Resource
win10v2004-20240508-en
General
-
Target
3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe
-
Size
538KB
-
MD5
90aaa10a02176c863eb287bef17bf3b9
-
SHA1
831883616deb50f70f177f6569d976bc543b393b
-
SHA256
3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1
-
SHA512
0eebae9937b6a77dfe85488cf494c5a21f8c2f85a876ef59cad645bd3836d317d646cd902c0895cf15de647832a557ce2e76a0521891d3741030dd17f012313e
-
SSDEEP
12288:wlbq+h1gL5pRTcAkS/3hzN8qE43fm78V6:Wbq+w5jcAkSYqyE6
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/memory/2836-1-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/files/0x000b000000015d59-5.dat UPX behavioral1/memory/2572-25-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2520-19-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2096-17-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2520-30-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2572-27-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2836-12-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral1/memory/2096-31-0x0000000000400000-0x000000000041B000-memory.dmp UPX -
Executes dropped EXE 4 IoCs
pid Process 2096 MSWDM.EXE 2520 MSWDM.EXE 2552 3B55C8B4875DB97F10E6A6F85446EE1988054BA8A035231619A3869D73C11AB1.EXE 2572 MSWDM.EXE -
Loads dropped DLL 2 IoCs
pid Process 2520 MSWDM.EXE 2936 Process not Found -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" MSWDM.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" MSWDM.EXE -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\MSWDM.EXE 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe File opened for modification C:\Windows\dev2829.tmp 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2520 MSWDM.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2836 wrote to memory of 2096 2836 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe 28 PID 2836 wrote to memory of 2096 2836 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe 28 PID 2836 wrote to memory of 2096 2836 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe 28 PID 2836 wrote to memory of 2096 2836 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe 28 PID 2836 wrote to memory of 2520 2836 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe 29 PID 2836 wrote to memory of 2520 2836 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe 29 PID 2836 wrote to memory of 2520 2836 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe 29 PID 2836 wrote to memory of 2520 2836 3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe 29 PID 2520 wrote to memory of 2552 2520 MSWDM.EXE 30 PID 2520 wrote to memory of 2552 2520 MSWDM.EXE 30 PID 2520 wrote to memory of 2552 2520 MSWDM.EXE 30 PID 2520 wrote to memory of 2552 2520 MSWDM.EXE 30 PID 2520 wrote to memory of 2572 2520 MSWDM.EXE 32 PID 2520 wrote to memory of 2572 2520 MSWDM.EXE 32 PID 2520 wrote to memory of 2572 2520 MSWDM.EXE 32 PID 2520 wrote to memory of 2572 2520 MSWDM.EXE 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe"C:\Users\Admin\AppData\Local\Temp\3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\WINDOWS\MSWDM.EXE"C:\WINDOWS\MSWDM.EXE"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2096
-
-
C:\WINDOWS\MSWDM.EXE-r!C:\Windows\dev2829.tmp!C:\Users\Admin\AppData\Local\Temp\3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe! !2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3B55C8B4875DB97F10E6A6F85446EE1988054BA8A035231619A3869D73C11AB1.EXE
- Executes dropped EXE
PID:2552
-
-
C:\WINDOWS\MSWDM.EXE-e!C:\Windows\dev2829.tmp!C:\Users\Admin\AppData\Local\Temp\3B55C8B4875DB97F10E6A6F85446EE1988054BA8A035231619A3869D73C11AB1.EXE!3⤵
- Executes dropped EXE
PID:2572
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD568e2b3feafd08549d8065f0d7bdf7428
SHA133f40e4b8d55ab73d5697f9a89b96451fd684ec9
SHA2560034a4b9e1272561a35b942a07d3cf5b6203f2a43b526f7a3f0bb9597b70cb56
SHA5127c6687f89338b237687c02927df93068e66d684a29ed7726f12fa083f31b9359e63771566e8279d4242e5357e9036d2bd8ecffb839ad6d09270d995e4665935f
-
\Users\Admin\AppData\Local\Temp\3b55c8b4875db97f10e6a6f85446ee1988054ba8a035231619a3869d73c11ab1.exe
Filesize458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628