Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 02:18

General

  • Target

    b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74.exe

  • Size

    1.4MB

  • MD5

    f2af0cf68dfd2a651cc66ad92ea4524a

  • SHA1

    95ccb921e2f012b426ee89b1901b28ef661d93eb

  • SHA256

    b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74

  • SHA512

    4cade9d6e64030d5bfb1dffe451efbba70c8c1a7d77b945fdd364870773504c634efc3a662b1ae2b2ceb1c39939a47efbb545ba65a1c634330df181119fac198

  • SSDEEP

    24576:T9cdOqX1uuMliQzd4mNy9Sh5hJgpiwVQLJaOSZ4LehoZza9gNWmAO5ehlM+:T9UX1uBx4mYo83vOSeyeaKrE

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 34 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74.exe
    "C:\Users\Admin\AppData\Local\Temp\b4041377281a95568381363ec6c3826d11948d1449bda36d6a0d6bb50e8c9a74.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2380
    • \??\c:\windows\system\explorer.exe
      c:\windows\system\explorer.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visiblity of hidden/system files in Explorer
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1964
      • \??\c:\windows\system\spoolsv.exe
        c:\windows\system\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2656
        • \??\c:\windows\system\svchost.exe
          c:\windows\system\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2792
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2704
          • C:\Windows\SysWOW64\at.exe
            at 02:21 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2580
          • C:\Windows\SysWOW64\at.exe
            at 02:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:652
          • C:\Windows\SysWOW64\at.exe
            at 02:23 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\mrsys.exe

    Filesize

    1.4MB

    MD5

    a055859c68317abbf638188e9da7f865

    SHA1

    715fc993f2a350a774d1da92b441fa05fbf37672

    SHA256

    c946ba7a05f049f7c3f1c39951f5cc7e97a2899a3e66e72d102409f6cb52c089

    SHA512

    920bc7771101d8abbd8462f1eafb1db37cd7a4e69fd254af5d51a1a7bb37caf1c185b55363927d20f350de9014ba826296144ede044c6e910306294e65060548

  • \Windows\system\explorer.exe

    Filesize

    1.4MB

    MD5

    2f7653ab9559e51b7ba70e750bd04135

    SHA1

    af69b730cea9bd9b82066a21c134a60e6b6fa50a

    SHA256

    2d212e68f07c7f6f8b57f14c47126a4846c2ea2989ef57e3c7b4f6553c098ecd

    SHA512

    2eec9367ea7f467039b0f946f9caa69593d873bb9afa0675ab5be484820e7b301d67f34696629248b55801cf633c8fda68577d6e5c595c523422e05875776029

  • \Windows\system\spoolsv.exe

    Filesize

    1.4MB

    MD5

    bb815d49b39c7949e9a52ee2bfee49ab

    SHA1

    8606ad91194d59f77423df4ad5c9857706fc227e

    SHA256

    fe377b62078dc5c8392ef150ab1a069855b4fe2ee307deff3096f8239cf32e61

    SHA512

    4fdd68f0e503e9c2d89e9f5d0f78f6409ff36920015a16c5998f20ce123d6cea63feff9509ecd5971f78ce77615f8936c4fd1cfd6ce9cdea096bfea7b4f806f4

  • \Windows\system\svchost.exe

    Filesize

    1.4MB

    MD5

    c8595d45355e5587214b546774582bf9

    SHA1

    0db75c1c96e7e08b7e519836e3aa4801276cae52

    SHA256

    0b142be2a52005fe0b5a5345525f36ee033ce56dbbb8e77608609742c5581a62

    SHA512

    ffa87d9aad1e487092a267aeef713e58519baae70d4dab6b26031c119594c60623ccff61406d7f7eaa91c86b4a0eb2c1635bf28e4e0d88f287d21cda8283e829

  • memory/1964-93-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/1964-30-0x0000000004440000-0x00000000049E0000-memory.dmp

    Filesize

    5.6MB

  • memory/1964-34-0x0000000004440000-0x00000000049E0000-memory.dmp

    Filesize

    5.6MB

  • memory/1964-96-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/1964-16-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/1964-83-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/1964-79-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/1964-70-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2380-0-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2380-14-0x0000000004710000-0x0000000004CB0000-memory.dmp

    Filesize

    5.6MB

  • memory/2380-68-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2380-1-0x0000000077790000-0x0000000077791000-memory.dmp

    Filesize

    4KB

  • memory/2380-62-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2656-31-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2656-67-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2656-54-0x0000000004690000-0x0000000004C30000-memory.dmp

    Filesize

    5.6MB

  • memory/2656-45-0x0000000004690000-0x0000000004C30000-memory.dmp

    Filesize

    5.6MB

  • memory/2704-59-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2704-61-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2792-63-0x0000000003E40000-0x00000000043E0000-memory.dmp

    Filesize

    5.6MB

  • memory/2792-71-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2792-74-0x0000000003E40000-0x00000000043E0000-memory.dmp

    Filesize

    5.6MB

  • memory/2792-82-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2792-55-0x0000000003E40000-0x00000000043E0000-memory.dmp

    Filesize

    5.6MB

  • memory/2792-49-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB

  • memory/2792-97-0x0000000000400000-0x00000000009A0000-memory.dmp

    Filesize

    5.6MB