Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

PO-2024-SGL-014.exe

windows7-x64

8

PO-2024-SGL-014.exe

windows10-2004-x64

8

Resubmissions

29/05/2024, 05:32

240529-f8gpxach46 8

Analysis

  • max time kernel
    25s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 05:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO-2024-SGL-014.exe

  • Size

    729KB

  • MD5

    d7bfd4fbd63b24a8848b0179ea7ad1e3

  • SHA1

    d82909d8315d72f13e0800cf2c8b8d714a08d87e

  • SHA256

    598e01cb5243265105853c0c275853142f95f34a1f21f339903d26a5878ef6f4

  • SHA512

    dad5e88c8223f8544111bc362e6888a34777691d20b0946361b263837186a0236df63d4e3c4f9802f990e5e85481558426e658684dc8dd58af83f3cde47a3740

  • SSDEEP

    12288:QnGihafKwYuHKtulnV9QVGRdGn6ZXfmZCdR28WPZ/krFExy/oK0jHbX+56ezb2uF:iuHQulVe6Gn6ZeDPSrWMQK0jHLRGjs45

Score
8/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO-2024-SGL-014.exe
    "C:\Users\Admin\AppData\Local\Temp\PO-2024-SGL-014.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-2024-SGL-014.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2480
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vWkeNiDbZOuBl.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2812
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vWkeNiDbZOuBl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp55FC.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2500
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp55FC.tmp
    Filesize

    1KB

    MD5

    2cff87e7eaf0a056d48c0eaeb5800739

    SHA1

    8609ebc35a85221b1ba4a39561f64ae64e5b25b4

    SHA256

    71fce93300c949ca873e8465be2a1492ce7d0523abb58b2801fe072c88f37de5

    SHA512

    59c3bb06d1c89a7036fb6ed86a3f4a9476cc66d136513edeac8203ae587d0791a81d4972015bc6671e6251b4cf1b2f7a6b37bf2ecfb3ca9b52f5d7b5ac878d41

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
    Filesize

    7KB

    MD5

    c978f348784c669992c452e917f5e3fa

    SHA1

    f5aeb4d72e9815cc71090bd750ab2fea9b8c53d7

    SHA256

    70e5748e1580315ca9ab899a0401c408ec0ffbb00f04ad5b9d85595f4bed7026

    SHA512

    6fbd0d34870ac673689aca2f56f59a06b8359d41d178f2ad18502f0aea52e586d559d71f4925730c393ce79f1ee5b64ae855299062ca3a3144f321f58d57ee15

    Download Submit

  • memory/2000-3-0x0000000074390000-0x0000000074A7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2000-0-0x000000007439E000-0x000000007439F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2000-4-0x0000000000390000-0x00000000003A0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2000-5-0x0000000005290000-0x000000000531A000-memory.dmp

    Filesize

    552KB

    Download

  • memory/2000-2-0x00000000005F0000-0x000000000060A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2000-1-0x00000000000F0000-0x00000000001AA000-memory.dmp

    Filesize

    744KB

    Download

  • memory/2000-24-0x0000000074390000-0x0000000074A7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2488-18-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

    Download

  • memory/2488-23-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

    Download

  • memory/2488-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2488-20-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

    Download