Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 20:24
Behavioral task
behavioral1
Sample
3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe
Resource
win10v2004-20240611-en
General
-
Target
3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe
-
Size
256KB
-
MD5
ef0546a86f8bc61f931e87474c80977d
-
SHA1
9f92cd8e52aed564f686c0ec57a1548ce27caba9
-
SHA256
3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853
-
SHA512
e043ae83ce3a002ffe70d5f409a5d4b6370559c01b00fe590de226a2621094e12b0bcc06fe247098f897a926e2fd38913eb06ce00ea9ae017d26e94293f8013b
-
SSDEEP
6144:wDLQxoyQ1LpnFyZ+dayL9rvolH8u3ZhGod:IQCyQ1LHk+zR7QHjGo
Malware Config
Signatures
-
Detects executables packed with VMProtect. 4 IoCs
resource yara_rule behavioral1/memory/1728-2-0x0000000000400000-0x000000000048C000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/1728-0-0x0000000000400000-0x000000000048C000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/memory/1728-19-0x0000000000400000-0x000000000048C000-memory.dmp INDICATOR_EXE_Packed_VMProtect behavioral1/files/0x000f00000001418d-21.dat INDICATOR_EXE_Packed_VMProtect -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\system32\drivers\etc\hosts 3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe -
Deletes itself 1 IoCs
pid Process 2500 cmd.exe -
resource yara_rule behavioral1/memory/1728-2-0x0000000000400000-0x000000000048C000-memory.dmp vmprotect behavioral1/memory/1728-0-0x0000000000400000-0x000000000048C000-memory.dmp vmprotect behavioral1/memory/1728-19-0x0000000000400000-0x000000000048C000-memory.dmp vmprotect behavioral1/files/0x000f00000001418d-21.dat vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2637.cn/?56" 3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1728 3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe Token: SeShutdownPrivilege 1760 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe 1760 explorer.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1728 wrote to memory of 1760 1728 3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe 28 PID 1728 wrote to memory of 1760 1728 3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe 28 PID 1728 wrote to memory of 1760 1728 3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe 28 PID 1728 wrote to memory of 1760 1728 3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe 28 PID 1728 wrote to memory of 2500 1728 3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe 29 PID 1728 wrote to memory of 2500 1728 3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe 29 PID 1728 wrote to memory of 2500 1728 3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe 29 PID 1728 wrote to memory of 2500 1728 3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe"C:\Users\Admin\AppData\Local\Temp\3b4fc8117a3228f3e4993fbb0adfebd93b714f1677e93f95b55fdb8381681853.exe"1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1760
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\yyyy.bat2⤵
- Deletes itself
PID:2500
-
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5c33dae20121003088a6717122912889d
SHA1cfd3ce79ebd9f813ec6a7aea1700ce489776cc05
SHA256c54ec841eb48a2e413d27eacee4e39653b93e3e479741482566967cc0e689f7c
SHA512553e2e8957ce18efd502cb94bba5fc9af001a17efaf6db4742c1a74ece1c7e5642ee856954162e2e3381704ec4a9a3d04c4c40953cb2831cd6846a9d200acac3
-
Filesize
337B
MD5efd7461ff257a05c2b27c3fa8b44feb3
SHA19f1ee75f69e62dd75791b3dd9e4e4103d89ee3b4
SHA256ba55801b55544afd76d2da2361d9f24011a51a646a37d46cf5fb882189f5a989
SHA5127a154c0806ab2da7a98d77fde5deb8e04fd444eec701f911f007cb3f554608cc716ac2914bf68921b1c91b52a9261903d123fe9370d6a420e3914ea345bb2419
-
Filesize
2KB
MD5a1d921556cf3a3d9d26b2ef002a7f87e
SHA16d35761aa3c8d24ab25db1d6a6e8a964bebd7121
SHA256be7dfb47e11615f6b0cda24d8d568fccb6cea492112f723b8784ee26cbe5d309
SHA512282607c9fc123c57dff829e728c4b08fe7fa27a130903907856127c9aec7d7f2c83c8e6d812208291c495cf25af195404d9010391cf53fcd12f2647475acc049