Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 19:44
Behavioral task
behavioral1
Sample
26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe
Resource
win10v2004-20240704-en
General
-
Target
26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe
-
Size
102KB
-
MD5
ca2141be819212436477a9d9023449b3
-
SHA1
9807b3934d78c7bf2bff91d61417c36f97416e9e
-
SHA256
26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958
-
SHA512
4038673cd5d7be4f2ae8c27e41c9093dbe9636ac98afc8ea2414152e5d57c701c932fe22b3a12130b7427497394a5ff5deeecc6c72a01fe8dbd4d2c7669dcdbd
-
SSDEEP
3072:xFphTfm1UC7AdYzrV+Dljy/32ubwZZqJ:FhTfmuCkdYzrVolu/J0ZZ
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3364 WindowsService.exe 1724 WindowsService.exe 528 WindowsService.exe -
Loads dropped DLL 5 IoCs
pid Process 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe -
resource yara_rule behavioral1/memory/2380-0-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/3104-446-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2380-444-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2380-443-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/2380-435-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/files/0x000a0000000122db-474.dat upx behavioral1/memory/3104-489-0x0000000003270000-0x00000000032AB000-memory.dmp upx behavioral1/memory/3364-493-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/1724-1041-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3364-1043-0x0000000000400000-0x000000000043B000-memory.dmp upx behavioral1/memory/3104-1047-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1724-1052-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindows\\WindowsService.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2380 set thread context of 3104 2380 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 31 PID 3364 set thread context of 1724 3364 WindowsService.exe 36 PID 3364 set thread context of 528 3364 WindowsService.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe Token: SeDebugPrivilege 1724 WindowsService.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2380 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 3364 WindowsService.exe 1724 WindowsService.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2380 wrote to memory of 3104 2380 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 31 PID 2380 wrote to memory of 3104 2380 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 31 PID 2380 wrote to memory of 3104 2380 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 31 PID 2380 wrote to memory of 3104 2380 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 31 PID 2380 wrote to memory of 3104 2380 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 31 PID 2380 wrote to memory of 3104 2380 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 31 PID 2380 wrote to memory of 3104 2380 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 31 PID 2380 wrote to memory of 3104 2380 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 31 PID 3104 wrote to memory of 3288 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 32 PID 3104 wrote to memory of 3288 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 32 PID 3104 wrote to memory of 3288 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 32 PID 3104 wrote to memory of 3288 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 32 PID 3288 wrote to memory of 3340 3288 cmd.exe 34 PID 3288 wrote to memory of 3340 3288 cmd.exe 34 PID 3288 wrote to memory of 3340 3288 cmd.exe 34 PID 3288 wrote to memory of 3340 3288 cmd.exe 34 PID 3104 wrote to memory of 3364 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 35 PID 3104 wrote to memory of 3364 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 35 PID 3104 wrote to memory of 3364 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 35 PID 3104 wrote to memory of 3364 3104 26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe 35 PID 3364 wrote to memory of 1724 3364 WindowsService.exe 36 PID 3364 wrote to memory of 1724 3364 WindowsService.exe 36 PID 3364 wrote to memory of 1724 3364 WindowsService.exe 36 PID 3364 wrote to memory of 1724 3364 WindowsService.exe 36 PID 3364 wrote to memory of 1724 3364 WindowsService.exe 36 PID 3364 wrote to memory of 1724 3364 WindowsService.exe 36 PID 3364 wrote to memory of 1724 3364 WindowsService.exe 36 PID 3364 wrote to memory of 1724 3364 WindowsService.exe 36 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37 PID 3364 wrote to memory of 528 3364 WindowsService.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe"C:\Users\Admin\AppData\Local\Temp\26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe"C:\Users\Admin\AppData\Local\Temp\26481db0a01dabedad8214120120d75a6801b6d2a875b0d34639f3e7814cc958.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\NINJK.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f4⤵
- Adds Run key to start application
PID:3340
-
-
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1724
-
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
PID:528
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157B
MD5f6a90c20834f271a907a4e2bc28184c2
SHA136c9d1602b74f622346fbb22693597d7889df48d
SHA25673f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd
SHA51239cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804
-
Filesize
102KB
MD5a265acb9d8aaa7f90fdba3b0cf6bf1a3
SHA1c81f171bc9fbafdb963a4619507f5c5c1b533672
SHA2569b007418e0fc053c20aee49efafa45301903d86b872204d147644db2037c1a70
SHA5120d7ee3dfdd23cd4b565db01a0233d754dda796873db60bba6e640c1e87976e98f5f39d189bd8a1bf2bb81fad6fa5f86830d476046e3ad283d59eb40feeea07dd