Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 03:19
Static task
static1
Behavioral task
behavioral1
Sample
a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe
Resource
win10v2004-20240704-en
General
-
Target
a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe
-
Size
135KB
-
MD5
a796ef28a106994c1a1c3a7863be7104
-
SHA1
6da415bb8f1946a97cc5c0622673f320d5d39404
-
SHA256
a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2
-
SHA512
bb6ef2107f18847b2f7092499bb1d47ddc0fef3b886069d24bf735e58a43c64825855cb1582fbb99124f7802a5267aeb620e46374d00fa7390c48a89fde5bcab
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVuWLY:UVqoCl/YgjxEufVU0TbTyDDalAWLY
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
Executes dropped EXE 4 IoCs
pid Process 1500 explorer.exe 2088 spoolsv.exe 2196 svchost.exe 2964 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1500 explorer.exe 2088 spoolsv.exe 2196 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1228 schtasks.exe 2696 schtasks.exe 1036 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 2196 svchost.exe 2196 svchost.exe 2196 svchost.exe 1500 explorer.exe 1500 explorer.exe 1500 explorer.exe 2196 svchost.exe 1500 explorer.exe 2196 svchost.exe 2196 svchost.exe 1500 explorer.exe 1500 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1500 explorer.exe 2196 svchost.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 1500 explorer.exe 1500 explorer.exe 2088 spoolsv.exe 2088 spoolsv.exe 2196 svchost.exe 2196 svchost.exe 2964 spoolsv.exe 2964 spoolsv.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1904 wrote to memory of 1500 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 31 PID 1904 wrote to memory of 1500 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 31 PID 1904 wrote to memory of 1500 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 31 PID 1904 wrote to memory of 1500 1904 a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe 31 PID 1500 wrote to memory of 2088 1500 explorer.exe 32 PID 1500 wrote to memory of 2088 1500 explorer.exe 32 PID 1500 wrote to memory of 2088 1500 explorer.exe 32 PID 1500 wrote to memory of 2088 1500 explorer.exe 32 PID 2088 wrote to memory of 2196 2088 spoolsv.exe 33 PID 2088 wrote to memory of 2196 2088 spoolsv.exe 33 PID 2088 wrote to memory of 2196 2088 spoolsv.exe 33 PID 2088 wrote to memory of 2196 2088 spoolsv.exe 33 PID 2196 wrote to memory of 2964 2196 svchost.exe 34 PID 2196 wrote to memory of 2964 2196 svchost.exe 34 PID 2196 wrote to memory of 2964 2196 svchost.exe 34 PID 2196 wrote to memory of 2964 2196 svchost.exe 34 PID 1500 wrote to memory of 1956 1500 explorer.exe 35 PID 1500 wrote to memory of 1956 1500 explorer.exe 35 PID 1500 wrote to memory of 1956 1500 explorer.exe 35 PID 1500 wrote to memory of 1956 1500 explorer.exe 35 PID 2196 wrote to memory of 2696 2196 svchost.exe 36 PID 2196 wrote to memory of 2696 2196 svchost.exe 36 PID 2196 wrote to memory of 2696 2196 svchost.exe 36 PID 2196 wrote to memory of 2696 2196 svchost.exe 36 PID 2196 wrote to memory of 1036 2196 svchost.exe 39 PID 2196 wrote to memory of 1036 2196 svchost.exe 39 PID 2196 wrote to memory of 1036 2196 svchost.exe 39 PID 2196 wrote to memory of 1036 2196 svchost.exe 39 PID 2196 wrote to memory of 1228 2196 svchost.exe 41 PID 2196 wrote to memory of 1228 2196 svchost.exe 41 PID 2196 wrote to memory of 1228 2196 svchost.exe 41 PID 2196 wrote to memory of 1228 2196 svchost.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe"C:\Users\Admin\AppData\Local\Temp\a8a462ba69ab7a143e7605615855e0892637b4741ba3691836f5da500796fba2.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2964
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:21 /f5⤵
- Scheduled Task/Job: Scheduled Task
PID:2696
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:22 /f5⤵
- Scheduled Task/Job: Scheduled Task
PID:1036
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 03:23 /f5⤵
- Scheduled Task/Job: Scheduled Task
PID:1228
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:1956
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5d80523945116090865857a9a44e61463
SHA168eb2a4fd48861bc1251376843e4a81e4baf9ed3
SHA2563fb12f92f61c285dcfa1e649e8603c8398be3667a7e4ca5af6d2ac4e85135705
SHA512ba816fe28662668503cdf912073cc7dc4f229b24ae805ea236969a93132fd51235e8231190a300806afae4c6d60b541bc73abc624fe7a8cf9b13bb67aa023a98
-
Filesize
135KB
MD59327b7d149d5259d1e91b26c40e2a84f
SHA101c7f9484a10d23bedc7c444e78ddda05ce3bece
SHA25613218c985ed6aa2b78d9f259361eb5464af691526401d9dd6eb5c5f5c937ab4a
SHA512f19dc20fe10e179a1ebb6a4288b0f22759d2332434e966295b65c444a5b54575f6cbf63495769775af1db53050e3bb1c46fb8edfdff2a6e6d12c11add5844c8b
-
Filesize
135KB
MD581c9bbeb56c8a5fa1913c4ccb7411a85
SHA139ceebaa959b443bcb5b83b37292146894805092
SHA256e6047e38c357f915591bf51be62fe89634c323fd7598be9fd9995d850d0193ff
SHA512e9699f11e703dae811c8234cc223dda57c69bda40bb1031ff196a318d6bc11acb294323460019c263131bdd55f012c9f9bf31135903820f8a70a898cfe542bce