Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe
-
Size
144KB
-
MD5
3d51fa29f89f6ec782f0c6467068256f
-
SHA1
976a83429aef53ad59b11b044a16e2c35df31229
-
SHA256
0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398
-
SHA512
7eef4edfa2c67c1ade9f6335a10860dc8c3a3c6626d0bdca108421d2c5efc549df669ce5eda0dd3a3d0df5ad73f0404ed032e82a1fe42c50313fe3da2fd6ac44
-
SSDEEP
3072:l5SVkkgUgXC7AdYzrV+Dljy/32ubwZ/qJ:SUFCkdYzrVolu/J0Z/
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1144 WindowsService.exe 1916 WindowsService.exe 860 WindowsService.exe -
Loads dropped DLL 5 IoCs
pid Process 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe -
resource yara_rule behavioral1/memory/2756-445-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1916-936-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2756-1033-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1916-1038-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindows\\WindowsService.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2028 set thread context of 2756 2028 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 30 PID 1144 set thread context of 1916 1144 WindowsService.exe 35 PID 1144 set thread context of 860 1144 WindowsService.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe Token: SeDebugPrivilege 1916 WindowsService.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2028 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 1144 WindowsService.exe 1916 WindowsService.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2756 2028 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 30 PID 2028 wrote to memory of 2756 2028 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 30 PID 2028 wrote to memory of 2756 2028 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 30 PID 2028 wrote to memory of 2756 2028 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 30 PID 2028 wrote to memory of 2756 2028 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 30 PID 2028 wrote to memory of 2756 2028 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 30 PID 2028 wrote to memory of 2756 2028 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 30 PID 2028 wrote to memory of 2756 2028 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 30 PID 2756 wrote to memory of 1584 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 31 PID 2756 wrote to memory of 1584 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 31 PID 2756 wrote to memory of 1584 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 31 PID 2756 wrote to memory of 1584 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 31 PID 1584 wrote to memory of 2944 1584 cmd.exe 33 PID 1584 wrote to memory of 2944 1584 cmd.exe 33 PID 1584 wrote to memory of 2944 1584 cmd.exe 33 PID 1584 wrote to memory of 2944 1584 cmd.exe 33 PID 2756 wrote to memory of 1144 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 34 PID 2756 wrote to memory of 1144 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 34 PID 2756 wrote to memory of 1144 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 34 PID 2756 wrote to memory of 1144 2756 0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe 34 PID 1144 wrote to memory of 1916 1144 WindowsService.exe 35 PID 1144 wrote to memory of 1916 1144 WindowsService.exe 35 PID 1144 wrote to memory of 1916 1144 WindowsService.exe 35 PID 1144 wrote to memory of 1916 1144 WindowsService.exe 35 PID 1144 wrote to memory of 1916 1144 WindowsService.exe 35 PID 1144 wrote to memory of 1916 1144 WindowsService.exe 35 PID 1144 wrote to memory of 1916 1144 WindowsService.exe 35 PID 1144 wrote to memory of 1916 1144 WindowsService.exe 35 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36 PID 1144 wrote to memory of 860 1144 WindowsService.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe"C:\Users\Admin\AppData\Local\Temp\0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe"C:\Users\Admin\AppData\Local\Temp\0cb8daebbab94e01cfc02f2a4612d1c9c35922f758e89ab02c50d576cf73b398.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\YUIUG.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2944
-
-
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1916
-
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:860
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157B
MD5f6a90c20834f271a907a4e2bc28184c2
SHA136c9d1602b74f622346fbb22693597d7889df48d
SHA25673f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd
SHA51239cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804
-
Filesize
144KB
MD56923a65983d5e941eb04b7bbbbefda97
SHA1f4ba5ecab88817ed87bb5e62c12ebf6709c02a81
SHA256f288d36defd01484943552206cf2a985541aee42e8eba1a02bed1562f77264a7
SHA51234d4f292f40747115b45e57414956db066c88fd423b5628a3b48d362c4038adf60f18822d12fcae005ca04920a06d0c0c17f9ff4925cb307d212271f5af8432b