Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 23:48
Static task
static1
Behavioral task
behavioral1
Sample
84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8.exe
Resource
win7-20240708-en
General
-
Target
84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8.exe
-
Size
615KB
-
MD5
50c63c4755e6c66e00cf03f19dc58c79
-
SHA1
fba01e2a251290603f8914c20f5ceb1f34c9aed5
-
SHA256
84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8
-
SHA512
29e0e7a925be2a32d0d0b9f03c75fcf7b0228893221f14f1336f60f908433e343ce3e81ac36d9a4013028d911184658d265fcb67b64d2ac6d6578c0cbc18a98d
-
SSDEEP
12288:HKUJfsE713jkOaEiEw4SArddOzlG3r+cYGN/Aw4/D/hAqisrKErSgZtZd:qUJfsu1ABEiEfrbORG3rDjKw2jprKErb
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1984-10-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-9-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-6-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-103-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-107-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-106-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-105-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-104-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-148-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-149-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-163-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-173-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-172-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-171-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-174-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-175-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-177-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-179-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx behavioral1/memory/1984-181-0x0000000001CC0000-0x0000000001DF1000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main 84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1984 84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8.exe 1984 84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1984 84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1984 84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8.exe 1984 84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8.exe"C:\Users\Admin\AppData\Local\Temp\84e0e7287eac726542844b88fd4f79409b95d40bfaf82f763db58074ccdce3f8.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156B
MD51ea9e5b417811379e874ad4870d5c51a
SHA1a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
-
Filesize
5KB
MD5fb45d7f6fb4d518a0ecc05cf7ce5363c
SHA1df12738b2ac098ce57c3173535feec07c5a9b3bf
SHA2564a01a4d6e711e873a065510a407cb6d37535d8becabbcfe9f05fe3dec13e5b9e
SHA5128cf60b35028266d459173db28d780a55acc8830ce8f86c2662be9864424134f647f10abb38e2aaaee24871c964eaea6abbb0eae256639d97c1e76ceddb7c3424
-
Filesize
506B
MD55335f1c12201b5f7cf5f8b4f5692e3d1
SHA113807a10369f7ff9ab3f9aba18135bccb98bec2d
SHA256974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
SHA5120d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df
-
Filesize
808B
MD5ccfbcbb51598a1946b19ff56c4ae9bd1
SHA183c5a77c766253d2c22e3b893408fe60acb46113
SHA2567ec494b43d8c70c338929fd88af752e117bb924a4284b93567e7b8c9cb79be9f
SHA5124a7b08a008350460beeb60e9473e497ab1c67d5ef60e927bb35a8cae574fd177b2c1a8e2df26d655e28b4ec4726d5616938ed4a612cbfcfa8f52f82d0de94426
-
Filesize
818B
MD50080e454f385670a88f35061cf5e38f6
SHA1d4c92fc751e13121a3c1e0ebea76971253b3f180
SHA256cf0fb643c27a564a0f94396e9c5209300a45be0e2564798bffad1f90359de507
SHA51219f83102603d9000c76f16e70a23a5c7b3bc5b37f85c7d92329e6d0c0c68bb409353229699d5a175f0d99f972d8f7a27cd0a5c465ecab27a504f76a844245dba
-
Filesize
698B
MD5124bc01ea52af57ca245837d87460f4b
SHA1d2726285b847e7d43c937f304b16b2cbce059662
SHA256f12fd05169348634a4fead731020fea3b9db80a1b1738b5db8488b45ef480475
SHA512e2f9006f8a0126ef9927a502dc1088a60af1fd36bd64deb5193e5abe2beaaeeb3c0bc47135070d7aa949205df592221e7b0bc62c3b5c420b59778b0dafa498ee
-
Filesize
719B
MD5316c96f3909516e4f402cdbf793010d9
SHA16d23fe123ff8f61aaa9226e43d7e815f00a5b960
SHA256458e1a7a46722533382277a934afd4e087fe52a5370c8b225ab6194acc420466
SHA51285376be911c5bb4cdec062992653ca484702f34265a083f79a3b4ba79d237276cdef767e016252dcfc8f0388d80a22e46a075703ef4358bb726b183d03371785
-
Filesize
493B
MD5818b8908ace0ccc5fecbca20f2919587
SHA1e599b4229d622c36bc6cd5b155c94c50d1a68b86
SHA256ad2ec992fc336af09f7be4a652d240936a08bf522d10ff7fbec5dbfe0c4d332d
SHA5127d63287a12f519524146f7ed620aee6724489fa351752e7eb64e99fae098e524e744e570d2b7abc21f89064cff2bdaa9864f7f0cda9fb9ca861d1df9a45bcd9f
-
Filesize
104B
MD535a600a752d3074501de31a516860499
SHA151eac62cf77a0b88a3e9cb9ee6f85def21fd4bcf
SHA25614e064857751b23da7bbe40861ef4caf99b2496227507b8e3108fbac6d901f75
SHA512046ec179571d239bfb2d51be9837f96d9afebf2e5db77bba0f4a25ce8716d37581a3f9753bd2dbb04c47711699a9d93987bceb71df0b8becf8c577d660320069
-
Filesize
812B
MD5eabb61abba55f80af418fa1128d1548d
SHA1a5ee1d55de2cc60966039120c830fc19cefb0351
SHA256717f3f02f5d5fd1478b6d2ec44acef6e70bb8f1adcf2dc030c08b92e851737e1
SHA512d232072c9540bf0e2fd56f353c2cc83518eabf8282cc02d9f8bec81c0341287ada29ba79f2a515d68722658686b6cce97be138a48f44409562d9a567af200bd6
-
Filesize
221B
MD507cd59b954e8495ad6cd6a7c11d2de86
SHA1787aeda3eee8053705fb208a6b399b8340820b82
SHA2566e6b964fd79b4a3461f128e2ed145b9b641d108b8616695f36387661cae995bb
SHA5120159aca0c2a49393fd91acd4b6819217e67f8fd01e220297eb3e0fdd8132fad794fc317f5cc5e2b761d4123da71478b97df776908de6740eb6d54187c6c00754
-
Filesize
681B
MD55f8dcbf4ebc42ad95cfc4d9401283972
SHA1e4060ea37daa2953bfdf8a773e447143f6365e75
SHA256931193720d26f0007ad223fca1a440f4866047a0ca96f5d29de3e62e7ba6a731
SHA512f918c4b834dff01c82f4b0063708d9155aef87b40fa3ae101d5d0a761ed17a348ff6ba4fb5f1e6ba4921698dcbb3e8291a25e48d180092107cb05660d948a61d
-
Filesize
15KB
MD5a82385e6e784a58498776f9001e536c5
SHA1a621597c1cb808e1dbeb767b82435983a58a38f6
SHA256d0fa6ec1933c54c4993f15bdf4293dbf918d7b2f213451f7e8d093d7314a2c95
SHA512da54185edc9c1ad91e2c2d8943ce9f06d6c549495fefa945c60b353bff1a6577d464370bc91b5ad840cd65733b429924978d9373f3c19f9a0d4908d9fa96b1f8
-
Filesize
207B
MD5c222a4f3d309721c0898606960120266
SHA1cdee967961a3ea87565ae7ca287be8ed20496160
SHA256f638cc042b7ade6f43f2faf0077e020137562e559178396b7e975db39ac13df6
SHA512db52224964ffd03fa65fddabea29d4f7c23840a18d1ad1028f228589c8c642280a762d2f4250159106f911455b8f0706a3b204dcbbb0484638d4f41f4f54a836
-
Filesize
207B
MD5f5bdb3cabdc15580d97fa94aa3397c08
SHA1d73b3bc67c9fe124768697cee7eec84c2b1eee4f
SHA256b28db98f2a6b06b6783b8fca6aabdcb89234d5bd4306fa71711988dba1fc71ea
SHA512511de8d97853457a37f89550f4b283ed69c05efdb7ce63657bc53b4e37ddf357577738be92da4bcd736d9c3c181c5ffc50b890c8cd5aa27099a87acf2c600fad
-
Filesize
10KB
MD557ca1a2085d82f0574e3ef740b9a5ead
SHA12974f4bf37231205a256f2648189a461e74869c0
SHA256476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
SHA5122d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c
-
Filesize
1KB
MD5fee48e5ee7ec6fb45cb1ba694147b9d5
SHA1006e9b855991d4235d731fd8c20fefe242f0be26
SHA256e1c4edcae55d155e6a1e123ded06bf2326bfe0edec1eff55b1c8df4bc1859225
SHA51220da304e95b5f63590e4fa6eaa3438903a2bb73f462bef80838418c0c15a7606dee6e87c317bb04173de5e24b4c0d3472f33e80f8dc8f104fd21295c01d73a80