Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    09/07/2024, 03:19

General

  • Target

    a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe

  • Size

    135KB

  • MD5

    a796ef28a106994c1a1c3a7863be7104

  • SHA1

    6da415bb8f1946a97cc5c0622673f320d5d39404

  • SHA256

    a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2

  • SHA512

    bb6ef2107f18847b2f7092499bb1d47ddc0fef3b886069d24bf735e58a43c64825855cb1582fbb99124f7802a5267aeb620e46374d00fa7390c48a89fde5bcab

  • SSDEEP

    1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVuWLY:UVqoCl/YgjxEufVU0TbTyDDalAWLY

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe
    "C:\Users\Admin\AppData\Local\Temp\a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1904
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1500
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2088
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2196
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2964
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:21 /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2696
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:22 /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1036
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:23 /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1228
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:1956

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      135KB

      MD5

      d80523945116090865857a9a44e61463

      SHA1

      68eb2a4fd48861bc1251376843e4a81e4baf9ed3

      SHA256

      3fb12f92f61c285dcfa1e649e8603c8398be3667a7e4ca5af6d2ac4e85135705

      SHA512

      ba816fe28662668503cdf912073cc7dc4f229b24ae805ea236969a93132fd51235e8231190a300806afae4c6d60b541bc73abc624fe7a8cf9b13bb67aa023a98

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      135KB

      MD5

      9327b7d149d5259d1e91b26c40e2a84f

      SHA1

      01c7f9484a10d23bedc7c444e78ddda05ce3bece

      SHA256

      13218c985ed6aa2b78d9f259361eb5464af691526401d9dd6eb5c5f5c937ab4a

      SHA512

      f19dc20fe10e179a1ebb6a4288b0f22759d2332434e966295b65c444a5b54575f6cbf63495769775af1db53050e3bb1c46fb8edfdff2a6e6d12c11add5844c8b

    • \Windows\Resources\svchost.exe

      Filesize

      135KB

      MD5

      81c9bbeb56c8a5fa1913c4ccb7411a85

      SHA1

      39ceebaa959b443bcb5b83b37292146894805092

      SHA256

      e6047e38c357f915591bf51be62fe89634c323fd7598be9fd9995d850d0193ff

      SHA512

      e9699f11e703dae811c8234cc223dda57c69bda40bb1031ff196a318d6bc11acb294323460019c263131bdd55f012c9f9bf31135903820f8a70a898cfe542bce

    • memory/1904-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/1904-8-0x00000000004C0000-0x00000000004DF000-memory.dmp

      Filesize

      124KB

    • memory/1904-43-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2088-31-0x00000000003E0000-0x00000000003FF000-memory.dmp

      Filesize

      124KB

    • memory/2088-42-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2964-41-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB