Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 18:16

General

  • Target

    04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe

  • Size

    66KB

  • MD5

    3e2428db2164bb359d7c6f4d6245bd85

  • SHA1

    5f0f3bfdd00b08e98011597e179b9f58fd510b81

  • SHA256

    04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d

  • SHA512

    0a88545e7755eac6be3ef832b2bd6f76c12e9a97e01bd57729618fb0ce519c9d163b1c277d8809dbfc4dbb46dde433b61dcc0992c5a887e77539a18adbe73c13

  • SSDEEP

    1536:EHfetdklPp+07gDSrB8Xru2zGeJxgawTzpXzrDJrXih:IeklMMYJhqezw/pXzH9ih

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe
    "C:\Users\Admin\AppData\Local\Temp\04d389168ddfda234692dc180bc23228fc87302c6efdfe68dfe921dd32df787d.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2724
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:940
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2712
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Modifies Installed Components in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1548
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2520
          • C:\Windows\SysWOW64\at.exe
            at 18:18 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
              PID:2452
            • C:\Windows\SysWOW64\at.exe
              at 18:19 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              5⤵
                PID:2368
              • C:\Windows\SysWOW64\at.exe
                at 18:20 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                5⤵
                  PID:2292

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          66KB

          MD5

          567d680abac687b7780b738681ae27d1

          SHA1

          47518e309a144f7c1bcdbfb66c978b2990710706

          SHA256

          4f733fcd024991f416df3d9af48cde7252a2a3b075c6cf06022db2d07d0bd9dd

          SHA512

          05bf17adf5e44b49c0c4ff393adbdb52bf41cdad302b8203fa82fe9fd29e6fdf5a3654609fcd3366f1e18b2b3cb49508cdc34d26ba0eac0333693482d956ed17

        • \Windows\system\explorer.exe

          Filesize

          66KB

          MD5

          2961a4013a53f09d80a584cbc428f349

          SHA1

          e29c69b22cfaebb823f8f3252606a9a8b2bbb0d4

          SHA256

          2cc77969890d52918fa2a362a21b952280ff217f519c074ed22d3d42d4f6cdcc

          SHA512

          5a4e0267349d44b8e20d819043b3b15534e662dd37144ab5d22de0535684f9cef755772a12224c62e971bd8b4ae72f105ef7a40670f03f53d9261a2b860c75cf

        • \Windows\system\spoolsv.exe

          Filesize

          66KB

          MD5

          49ab39548e7eaa686c4eac1228f87216

          SHA1

          82036e34234e8789acabb3d3f6c649c05d975bc3

          SHA256

          dca402af341c60d8fc451b6f45b7fb5f07db3b4c7369c8f0e8b9689a02de1361

          SHA512

          91d0a9a861276bcc049bc702cd6e02f23c0cbbf971b8c02553d2d5b975536741959230f5cb3736e07ebdd377cf486bf10c5eecd9b12c99addc7f01290e304732

        • \Windows\system\svchost.exe

          Filesize

          66KB

          MD5

          b60432ccc8e2acd60993609f898b9902

          SHA1

          abd43678e33f98c6c5f457d268173b21efdfb17f

          SHA256

          a27b8aa8066717c51fd65229b7e0e77ea598c4466f7faf202c820648be7251c6

          SHA512

          db02783c16ac1a44276dae03d92cb2c7352febde94b73c928623d7da1645ffc742f8a049d30b3c244ed6ec685471b939b24b9223234f6b83f485fe57ade2a5af

        • memory/940-19-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/940-91-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/940-81-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/940-20-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/940-24-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/940-35-0x0000000002B40000-0x0000000002B71000-memory.dmp

          Filesize

          196KB

        • memory/940-61-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1548-57-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/1548-82-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1548-56-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/1548-62-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2520-68-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2520-73-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2712-37-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2712-38-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2712-42-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2712-77-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2712-55-0x0000000002470000-0x00000000024A1000-memory.dmp

          Filesize

          196KB

        • memory/2724-3-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2724-4-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2724-54-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2724-78-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2724-2-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2724-79-0x0000000000401000-0x000000000042E000-memory.dmp

          Filesize

          180KB

        • memory/2724-1-0x0000000000020000-0x0000000000024000-memory.dmp

          Filesize

          16KB

        • memory/2724-0-0x0000000000400000-0x0000000000431000-memory.dmp

          Filesize

          196KB

        • memory/2724-16-0x00000000027F0000-0x0000000002821000-memory.dmp

          Filesize

          196KB

        • memory/2724-17-0x00000000027F0000-0x0000000002821000-memory.dmp

          Filesize

          196KB