Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 19:39
Behavioral task
behavioral1
Sample
239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe
Resource
win7-20240221-en
General
-
Target
239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe
-
Size
59KB
-
MD5
9642cdbed8cbe95aecd3f3bfa300cb79
-
SHA1
fc2bd4fbed62228fcf795522d374399749bbcb20
-
SHA256
239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab
-
SHA512
056a0f37acbf7759eeacd7542bbfde2da46971b1de215e98224e52a23f50358e766f7c509faa20c6d2df9338532217747592889b943fb0d3aa965e1304c924dd
-
SSDEEP
768:mrItKyw5WHXfQmjIiIk9ecAaU896KyXmuJrjTg+5lPulnp:mr3Z5IfQmv81aU85yXmIjTg4Mp
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 5 IoCs
resource yara_rule behavioral1/memory/2888-0-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2864-5-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/files/0x000d000000014698-4.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2888-6-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2864-7-0x0000000000400000-0x0000000000414000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral1/memory/2888-0-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral1/memory/2864-5-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral1/files/0x000d000000014698-4.dat UPX behavioral1/memory/2888-6-0x0000000000400000-0x0000000000414000-memory.dmp UPX behavioral1/memory/2864-7-0x0000000000400000-0x0000000000414000-memory.dmp UPX -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2100 attrib.exe -
Deletes itself 1 IoCs
pid Process 2148 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2864 rwmhost.exe -
resource yara_rule behavioral1/memory/2888-0-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2864-5-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/files/0x000d000000014698-4.dat upx behavioral1/memory/2888-6-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/2864-7-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Debug\rwmhost.exe 239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe File opened for modification C:\Windows\Debug\rwmhost.exe 239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe File opened for modification C:\Windows\Debug\rwmhost.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2888 239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2100 2888 239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe 28 PID 2888 wrote to memory of 2100 2888 239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe 28 PID 2888 wrote to memory of 2100 2888 239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe 28 PID 2888 wrote to memory of 2100 2888 239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe 28 PID 2888 wrote to memory of 2148 2888 239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe 31 PID 2888 wrote to memory of 2148 2888 239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe 31 PID 2888 wrote to memory of 2148 2888 239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe 31 PID 2888 wrote to memory of 2148 2888 239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe 31 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2100 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe"C:\Users\Admin\AppData\Local\Temp\239a145066beb4635d484e7071587174406d9f90b85bccdb8176e70210eac8ab.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\attrib.exeattrib +a +s +h +r C:\Windows\Debug\rwmhost.exe2⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:2100
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\239A14~1.EXE > nul2⤵
- Deletes itself
PID:2148
-
-
C:\Windows\Debug\rwmhost.exeC:\Windows\Debug\rwmhost.exe1⤵
- Executes dropped EXE
PID:2864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD56c0fe786524105b1cb64a26459ad97e6
SHA114e78799e3f8e33db6791fc067e14e701bd0a89e
SHA256e042479364e189b1b16fc15382fd3f5eec14f5006ff09497379f427317fbb329
SHA512cf6166d85fecd6722ee58a931794e31b7f949d4d9989945e87baa5eb9729e7511684ccc843fa7ef0abaa34b9d1efe647e09908b1863a80a868a13bb7dbc66fad