Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
30/05/2024, 02:38
General
-
Target
SEBarClt.exe
-
Size
795KB
-
MD5
5dfbaf5dbeb8f33c936de5493dd6a7b9
-
SHA1
aae268ee625544c42e5834a822ba82683dcbabeb
-
SHA256
5487495896ff389b9c0d950e1d158678cd028fb231517a02c1db918a7e172c1d
-
SHA512
2876a24573b452ba6fca8dd2c1782759f3e80d5182185ca8fa6d392cb90eb1f56d97116aec8a12a21490952cc71f5a7373105996426d234c1c16959e760ccbc6
-
SSDEEP
24576:w3qnzFNKEgNumi2S/JOc/cwKy1gmk4QqCs:w3fchUucwKyu/hs
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SEBarClt.exe"C:\Users\Admin\AppData\Local\Temp\SEBarClt.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Explorer.exe"C:\Users\Admin\AppData\Local\Temp\Explorer.exe" "C:\Users\Admin\AppData\Local\Temp\SEBarClt.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
795KB
MD55dfbaf5dbeb8f33c936de5493dd6a7b9
SHA1aae268ee625544c42e5834a822ba82683dcbabeb
SHA2565487495896ff389b9c0d950e1d158678cd028fb231517a02c1db918a7e172c1d
SHA5122876a24573b452ba6fca8dd2c1782759f3e80d5182185ca8fa6d392cb90eb1f56d97116aec8a12a21490952cc71f5a7373105996426d234c1c16959e760ccbc6
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
4KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
4KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
4KB