Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 19:22
Static task
static1
Behavioral task
behavioral1
Sample
161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93.exe
Resource
win10v2004-20240709-en
General
-
Target
161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93.exe
-
Size
45KB
-
MD5
cc60b3a26d75bd3698cf62e8bb0c73e9
-
SHA1
d8624de6dcc1c8fd70f4db8435589244e965c9cd
-
SHA256
161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93
-
SHA512
d49b91b4bd1037c4c61932a70f55fbeb8267408efaade11e4de2c4b75ba3a179c0994ee94e75a150b3756c08ed72c0c8cbbd064196aaccd46a7407cd964a619b
-
SSDEEP
768:WAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGVAQvKMb7r1:RUNHFKQbIkHvGkAFu7J
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F4E4E47-4a49-4a55-4F4E-4E474A494a55} rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F4E4E47-4a49-4a55-4F4E-4E474A494a55}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F4E4E47-4a49-4a55-4F4E-4E474A494a55}\IsInstalled = "1" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F4E4E47-4a49-4a55-4F4E-4E474A494a55}\StubPath = "C:\\Windows\\system32\\ahuy.exe" rmass.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rmass.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" rmass.exe -
Executes dropped EXE 2 IoCs
pid Process 3824 rmass.exe 400 rmass.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" rmass.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rmass.exe 161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93.exe File created C:\Windows\SysWOW64\rmass.exe 161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe rmass.exe File opened for modification C:\Windows\SysWOW64\aset32.exe rmass.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe rmass.exe File created C:\Windows\SysWOW64\ntdbg.exe rmass.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe rmass.exe File created C:\Windows\SysWOW64\ahuy.exe rmass.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File created C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe rmass.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe rmass.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3824 rmass.exe 3824 rmass.exe 3824 rmass.exe 3824 rmass.exe 3824 rmass.exe 3824 rmass.exe 400 rmass.exe 400 rmass.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3296 161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93.exe Token: SeDebugPrivilege 3824 rmass.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3296 wrote to memory of 3824 3296 161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93.exe 83 PID 3296 wrote to memory of 3824 3296 161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93.exe 83 PID 3296 wrote to memory of 3824 3296 161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93.exe 83 PID 3824 wrote to memory of 616 3824 rmass.exe 5 PID 3824 wrote to memory of 400 3824 rmass.exe 84 PID 3824 wrote to memory of 400 3824 rmass.exe 84 PID 3824 wrote to memory of 400 3824 rmass.exe 84 PID 3824 wrote to memory of 3440 3824 rmass.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93.exe"C:\Users\Admin\AppData\Local\Temp\161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\rmass.exe"C:\Windows\system32\rmass.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\rmass.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:400
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD52b2c28a7a01f9584fe220ef84003427f
SHA15fc023df0b5064045eb8de7f2dbe26f07f6fec70
SHA2569e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb
SHA51239192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78
-
Filesize
47KB
MD51e981e6bf150fe560f9f08fa01120de8
SHA17e057e67be7ec27eb7df3affa176dfdab997b69f
SHA256d52115dc22231fbf743c52cd45fab09ad4b43e14e899dd3df18caecc4037fc17
SHA5123265bdc0d1c8b3e103e7111f6f73d0e4853c48a6e01caf39fbfd89818c2b69cb01dfad90b5fe3945fe98d4cbf5d472effe8e37324fa220d833dbe1ce2d07a45a
-
Filesize
48KB
MD5f7f3d01ea0d3e2110ff7f9a043862237
SHA158b601d906ec0bc53f00d0cc6d4070ed20650b0f
SHA25675c82b1bf52ca6a5c7546f71de1af3ab17ba68dd3fa8233f984d7a124815817a
SHA512246041ba615442a4c957c460c054c99cd69d90e6f5b0876f934b73b2b99485a3c1a95cdc6ec4a823111e52bb9aa3bdfa5180ac28952a2e0197372165668bd62a
-
Filesize
45KB
MD5cc60b3a26d75bd3698cf62e8bb0c73e9
SHA1d8624de6dcc1c8fd70f4db8435589244e965c9cd
SHA256161808cf2c7e8288bbd15b60bdbd0afc4d568f5d0eebc959278ed25eb1f04c93
SHA512d49b91b4bd1037c4c61932a70f55fbeb8267408efaade11e4de2c4b75ba3a179c0994ee94e75a150b3756c08ed72c0c8cbbd064196aaccd46a7407cd964a619b
-
Filesize
1KB
MD56f47b62de25d1745e296a06b3f98ed19
SHA1a688bb35a4c8a5cc198985d624a1b5a6ac5b9f6f
SHA25615c7218eb9cef5fa0573db657b15ce3a5f0e0609f1166df8098ca7152df505b4
SHA512dea26fff8060f44bf20fe4fff2ecbacf428727f10c0f5886fb4813e28fce9cbc3d088337c84edd9857b18514c83f1bb1cf0f51518aaecef09f30e921f4d758d7