Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 08:18
Behavioral task
behavioral1
Sample
Artic.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Artic.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
�}l��.pyc
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
�}l��.pyc
Resource
win10v2004-20240709-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
Artic.exe
-
Size
7.4MB
-
MD5
b1da93350f3c968fc3632997ab5a9ac2
-
SHA1
b8f9388e3b29218b6860167c825dfece6d5adfa8
-
SHA256
f0fd55719640ba0ce349df5e3de0b043ba11f53551e6454129240b488df673b1
-
SHA512
aeb24ffe86ec47cb6b1236840af065f8cfef781ff455bef5b5f4da157e13ef8d88c965ddd91fb0c785028c3c32370b2a39375c133cd9d38feb32282952d0e688
-
SSDEEP
98304:63VeYgZhU0way6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3zCUTVv9JT1sOBNJ:6wYS6UOshoKMuIkhVastRL5Di3u01D7J
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2928 Artic.exe -
resource yara_rule behavioral1/files/0x0005000000018f9c-21.dat upx behavioral1/memory/2928-23-0x000007FEF6750000-0x000007FEF6D39000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\taskschd.msc mmc.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2716 mmc.exe Token: SeIncBasePriorityPrivilege 2716 mmc.exe Token: 33 2880 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2880 AUDIODG.EXE Token: 33 2880 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2880 AUDIODG.EXE Token: SeDebugPrivilege 2216 taskmgr.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe -
Suspicious use of SendNotifyMessage 30 IoCs
pid Process 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe 2216 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2716 mmc.exe 2716 mmc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2928 1900 Artic.exe 30 PID 1900 wrote to memory of 2928 1900 Artic.exe 30 PID 1900 wrote to memory of 2928 1900 Artic.exe 30 PID 2716 wrote to memory of 2396 2716 mmc.exe 32 PID 2716 wrote to memory of 2396 2716 mmc.exe 32 PID 2716 wrote to memory of 2396 2716 mmc.exe 32 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Artic.exe"C:\Users\Admin\AppData\Local\Temp\Artic.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\Artic.exe"C:\Users\Admin\AppData\Local\Temp\Artic.exe"2⤵
- Loads dropped DLL
PID:2928
-
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 8762⤵PID:2396
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2024
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1981⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab