Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

05/07/2024, 15:43

240705-s54fqatcng 10

05/07/2024, 12:00

240705-n6l6lszhng 10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/07/2024, 12:00

General

  • Target

    ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe

  • Size

    2.4MB

  • MD5

    fea126096e142649211027c6edbb9832

  • SHA1

    e5e259235d3d77065918b3c4c369f9d74f1868d7

  • SHA256

    950a5c5455b3d7a4ee27ff5bc7cea2ade2d507770a3cc15106018bfedae9ca52

  • SHA512

    1f50c406c59fa74b95d97596a04b2cc132ede28bbe00c306aaa1bd3056942713f99aa5e5cf93022d652abb2fcacf7d6e24feec4e572a9aaff64368d1b0d28293

  • SSDEEP

    12288:SSR2wX/utnvc69mP51M1nkPpVys8b5V29HxJu5YF9Iv3dosUg7JZtY:SSHuRc69mP/M5kmL/aHxJZIv3W42

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe
      "C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe"
      2⤵
      • UAC bypass
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2420
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ORDEN DE COMPRA URGENTE‮f؜d؜p؜..exe" -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2552
      • C:\Windows\System32\notepad.exe
        "C:\Windows\System32\notepad.exe"
        3⤵
          PID:2684
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
          3⤵
            PID:2584
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:2496
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 2420 -s 944
            3⤵
              PID:2740
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\SysWOW64\sc.exe"
            2⤵
            • Adds policy Run key to start application
            • Suspicious use of SetThreadContext
            • Launches sc.exe
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:1952

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1952-22-0x00000000000D0000-0x000000000010F000-memory.dmp

          Filesize

          252KB

        • memory/1952-21-0x00000000000D0000-0x000000000010F000-memory.dmp

          Filesize

          252KB

        • memory/2420-0-0x000007FEF5863000-0x000007FEF5864000-memory.dmp

          Filesize

          4KB

        • memory/2420-1-0x0000000000D10000-0x0000000000D5C000-memory.dmp

          Filesize

          304KB

        • memory/2420-2-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

          Filesize

          9.9MB

        • memory/2420-3-0x000000001B930000-0x000000001B97C000-memory.dmp

          Filesize

          304KB

        • memory/2420-4-0x0000000000600000-0x000000000069A000-memory.dmp

          Filesize

          616KB

        • memory/2420-18-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

          Filesize

          9.9MB

        • memory/2420-17-0x000007FEF5863000-0x000007FEF5864000-memory.dmp

          Filesize

          4KB

        • memory/2496-15-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2552-14-0x00000000028E0000-0x00000000028E8000-memory.dmp

          Filesize

          32KB

        • memory/2552-13-0x000000001B630000-0x000000001B912000-memory.dmp

          Filesize

          2.9MB

        • memory/2684-11-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB

        • memory/2684-9-0x0000000000400000-0x0000000000442000-memory.dmp

          Filesize

          264KB