Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 19:45
Behavioral task
behavioral1
Sample
f0923129095f1d513fee0d69ec55dca0N.exe
Resource
win7-20240705-en
General
-
Target
f0923129095f1d513fee0d69ec55dca0N.exe
-
Size
1.1MB
-
MD5
f0923129095f1d513fee0d69ec55dca0
-
SHA1
f7ff12f022dfacd7f69e04959cf09b4e103c69fa
-
SHA256
38e8049a0a3684d390d14a1a4a6857ebf6935aadcd13fc3bc7ca06945a2b8590
-
SHA512
046bed89ae37a65091755cd8c2e18c6d268fa306ca10d142f645d538aa5587461658063ccd9bea88e132300cb20a07bc2848e345fd4a38c209bb23fa2d70f249
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9+s8juCCm:E5aIwC+Agr6SNasrsFCn
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule behavioral1/files/0x0007000000017502-22.dat family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
resource yara_rule behavioral1/memory/1700-15-0x0000000000350000-0x0000000000379000-memory.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
pid Process 2740 f0923129096f1d613fee0d79ec66dca0N.exe 1504 f0923129096f1d613fee0d79ec66dca0N.exe -
Loads dropped DLL 2 IoCs
pid Process 1700 f0923129095f1d513fee0d69ec55dca0N.exe 1700 f0923129095f1d513fee0d69ec55dca0N.exe -
pid Process 2848 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2876 sc.exe 2204 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0923129096f1d613fee0d79ec66dca0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0923129095f1d513fee0d69ec55dca0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f0923129096f1d613fee0d79ec66dca0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1700 f0923129095f1d513fee0d69ec55dca0N.exe 1700 f0923129095f1d513fee0d69ec55dca0N.exe 1700 f0923129095f1d513fee0d69ec55dca0N.exe 2848 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2848 powershell.exe Token: SeTcbPrivilege 1504 f0923129096f1d613fee0d79ec66dca0N.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1700 f0923129095f1d513fee0d69ec55dca0N.exe 2740 f0923129096f1d613fee0d79ec66dca0N.exe 1504 f0923129096f1d613fee0d79ec66dca0N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2212 1700 f0923129095f1d513fee0d69ec55dca0N.exe 31 PID 1700 wrote to memory of 2212 1700 f0923129095f1d513fee0d69ec55dca0N.exe 31 PID 1700 wrote to memory of 2212 1700 f0923129095f1d513fee0d69ec55dca0N.exe 31 PID 1700 wrote to memory of 2212 1700 f0923129095f1d513fee0d69ec55dca0N.exe 31 PID 1700 wrote to memory of 2116 1700 f0923129095f1d513fee0d69ec55dca0N.exe 32 PID 1700 wrote to memory of 2116 1700 f0923129095f1d513fee0d69ec55dca0N.exe 32 PID 1700 wrote to memory of 2116 1700 f0923129095f1d513fee0d69ec55dca0N.exe 32 PID 1700 wrote to memory of 2116 1700 f0923129095f1d513fee0d69ec55dca0N.exe 32 PID 1700 wrote to memory of 1972 1700 f0923129095f1d513fee0d69ec55dca0N.exe 34 PID 1700 wrote to memory of 1972 1700 f0923129095f1d513fee0d69ec55dca0N.exe 34 PID 1700 wrote to memory of 1972 1700 f0923129095f1d513fee0d69ec55dca0N.exe 34 PID 1700 wrote to memory of 1972 1700 f0923129095f1d513fee0d69ec55dca0N.exe 34 PID 1700 wrote to memory of 2740 1700 f0923129095f1d513fee0d69ec55dca0N.exe 37 PID 1700 wrote to memory of 2740 1700 f0923129095f1d513fee0d69ec55dca0N.exe 37 PID 1700 wrote to memory of 2740 1700 f0923129095f1d513fee0d69ec55dca0N.exe 37 PID 1700 wrote to memory of 2740 1700 f0923129095f1d513fee0d69ec55dca0N.exe 37 PID 2116 wrote to memory of 2204 2116 cmd.exe 38 PID 2116 wrote to memory of 2204 2116 cmd.exe 38 PID 2116 wrote to memory of 2204 2116 cmd.exe 38 PID 2116 wrote to memory of 2204 2116 cmd.exe 38 PID 2212 wrote to memory of 2876 2212 cmd.exe 39 PID 2212 wrote to memory of 2876 2212 cmd.exe 39 PID 2212 wrote to memory of 2876 2212 cmd.exe 39 PID 2212 wrote to memory of 2876 2212 cmd.exe 39 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 1972 wrote to memory of 2848 1972 cmd.exe 40 PID 1972 wrote to memory of 2848 1972 cmd.exe 40 PID 1972 wrote to memory of 2848 1972 cmd.exe 40 PID 1972 wrote to memory of 2848 1972 cmd.exe 40 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 2740 wrote to memory of 1496 2740 f0923129096f1d613fee0d79ec66dca0N.exe 41 PID 1636 wrote to memory of 1504 1636 taskeng.exe 43 PID 1636 wrote to memory of 1504 1636 taskeng.exe 43 PID 1636 wrote to memory of 1504 1636 taskeng.exe 43 PID 1636 wrote to memory of 1504 1636 taskeng.exe 43 PID 1504 wrote to memory of 2580 1504 f0923129096f1d613fee0d79ec66dca0N.exe 44 PID 1504 wrote to memory of 2580 1504 f0923129096f1d613fee0d79ec66dca0N.exe 44 PID 1504 wrote to memory of 2580 1504 f0923129096f1d613fee0d79ec66dca0N.exe 44 PID 1504 wrote to memory of 2580 1504 f0923129096f1d613fee0d79ec66dca0N.exe 44 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0923129095f1d513fee0d69ec55dca0N.exe"C:\Users\Admin\AppData\Local\Temp\f0923129095f1d513fee0d69ec55dca0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2876
-
-
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2204
-
-
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
-
C:\Users\Admin\AppData\Roaming\WinSocket\f0923129096f1d613fee0d79ec66dca0N.exeC:\Users\Admin\AppData\Roaming\WinSocket\f0923129096f1d613fee0d79ec66dca0N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:1496
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {37E76B25-8725-4E67-A329-696629C6A507} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Roaming\WinSocket\f0923129096f1d613fee0d79ec66dca0N.exeC:\Users\Admin\AppData\Roaming\WinSocket\f0923129096f1d613fee0d79ec66dca0N.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2580
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5f0923129095f1d513fee0d69ec55dca0
SHA1f7ff12f022dfacd7f69e04959cf09b4e103c69fa
SHA25638e8049a0a3684d390d14a1a4a6857ebf6935aadcd13fc3bc7ca06945a2b8590
SHA512046bed89ae37a65091755cd8c2e18c6d268fa306ca10d142f645d538aa5587461658063ccd9bea88e132300cb20a07bc2848e345fd4a38c209bb23fa2d70f249