Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 07:16
Behavioral task
behavioral1
Sample
63679243c47c8c9690b42098778611c0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
63679243c47c8c9690b42098778611c0N.exe
Resource
win10v2004-20240709-en
General
-
Target
63679243c47c8c9690b42098778611c0N.exe
-
Size
21KB
-
MD5
63679243c47c8c9690b42098778611c0
-
SHA1
ec59c9fc2e5a18114f0abde2e3ea99510897a56b
-
SHA256
8ac15f82a2bb641c962e25e2d50c83697a544218b80da5e4378b8f6ad4f86dc2
-
SHA512
f8385fa201d92443675dce1efcab89b824544abc4663152717c1765d023b79310495f2dd0f467a238be2aa6144915120d54d4079d125c7335c67d8ded8748a54
-
SSDEEP
384:UBWoC5GDr6wc/w3HgM6vDUTAXBGCVf4WVlFvX6S3k5i:rRkiLw3HsDSARGG/qS3yi
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5250584F-4351-5246-5250-584F43515246} rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5250584F-4351-5246-5250-584F43515246}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5250584F-4351-5246-5250-584F43515246}\IsInstalled = "1" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5250584F-4351-5246-5250-584F43515246}\StubPath = "C:\\Windows\\system32\\ahuy.exe" rmass.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rmass.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" rmass.exe -
Executes dropped EXE 2 IoCs
pid Process 2784 rmass.exe 2736 rmass.exe -
Loads dropped DLL 3 IoCs
pid Process 2780 63679243c47c8c9690b42098778611c0N.exe 2780 63679243c47c8c9690b42098778611c0N.exe 2784 rmass.exe -
resource yara_rule behavioral1/memory/2780-0-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/files/0x000a000000012029-12.dat upx behavioral1/memory/2780-11-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/memory/2736-25-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/memory/2784-13-0x0000000000400000-0x0000000000411000-memory.dmp upx behavioral1/memory/2784-59-0x0000000000400000-0x0000000000411000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" rmass.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rmass.exe 63679243c47c8c9690b42098778611c0N.exe File created C:\Windows\SysWOW64\rmass.exe 63679243c47c8c9690b42098778611c0N.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe rmass.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe rmass.exe File created C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe rmass.exe File opened for modification C:\Windows\SysWOW64\aset32.exe rmass.exe File created C:\Windows\SysWOW64\ntdbg.exe rmass.exe File created C:\Windows\SysWOW64\ahuy.exe rmass.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe rmass.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe rmass.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2784 rmass.exe 2784 rmass.exe 2784 rmass.exe 2736 rmass.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2780 63679243c47c8c9690b42098778611c0N.exe Token: SeDebugPrivilege 2784 rmass.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2784 2780 63679243c47c8c9690b42098778611c0N.exe 31 PID 2780 wrote to memory of 2784 2780 63679243c47c8c9690b42098778611c0N.exe 31 PID 2780 wrote to memory of 2784 2780 63679243c47c8c9690b42098778611c0N.exe 31 PID 2780 wrote to memory of 2784 2780 63679243c47c8c9690b42098778611c0N.exe 31 PID 2784 wrote to memory of 432 2784 rmass.exe 5 PID 2784 wrote to memory of 1232 2784 rmass.exe 21 PID 2784 wrote to memory of 2736 2784 rmass.exe 32 PID 2784 wrote to memory of 2736 2784 rmass.exe 32 PID 2784 wrote to memory of 2736 2784 rmass.exe 32 PID 2784 wrote to memory of 2736 2784 rmass.exe 32
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\63679243c47c8c9690b42098778611c0N.exe"C:\Users\Admin\AppData\Local\Temp\63679243c47c8c9690b42098778611c0N.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\rmass.exe"C:\Windows\system32\rmass.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\rmass.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2736
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD52b2c28a7a01f9584fe220ef84003427f
SHA15fc023df0b5064045eb8de7f2dbe26f07f6fec70
SHA2569e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb
SHA51239192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78
-
Filesize
23KB
MD500ec08539ee63bbc069978d9d2262092
SHA14d88ce31d5414f63d6665ad8ede50591bb605687
SHA256e78a107303d39f995019757487f452b080f1d8aa170ad3141eba0b8f96a61897
SHA5128a7490e398a2b185b9a0f02ac1532d3d179ec83972cf99c8b4fddfa1f2e0d6d3bbc8e0433185d839bc5521995dcdbf7ca93d456da7144b3c76a477f75729ffb0
-
Filesize
24KB
MD5a5260a607b6228e2fb7ee07a571695af
SHA17e3c020e3ffef41a71b13f33006f09de3ae8daad
SHA2568e016e168c16e447839c3186a3b64606be1587657c71312bdfb960c8b3ca1989
SHA512a8b1910bed141cd26a5f5e07eca0c14ae2146bf02b8ee047d8c06d6289cd67bc9dc49a9cb52107d199533b5fdb80b83b2c5e2ac4d9b9a5ba082346a5f774df9f
-
Filesize
21KB
MD563679243c47c8c9690b42098778611c0
SHA1ec59c9fc2e5a18114f0abde2e3ea99510897a56b
SHA2568ac15f82a2bb641c962e25e2d50c83697a544218b80da5e4378b8f6ad4f86dc2
SHA512f8385fa201d92443675dce1efcab89b824544abc4663152717c1765d023b79310495f2dd0f467a238be2aa6144915120d54d4079d125c7335c67d8ded8748a54