Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
27/07/2024, 23:46
General
-
Target
$PROGRAMFILES/SoftForum/XecureWeb/AnySign/dll/Any_setup.exe
-
Size
144KB
-
MD5
894222e8962b46263c26aa9ea08c2050
-
SHA1
9778d5e7d4cd15717f3240cae4255934ccd5231c
-
SHA256
e5c6a460471e5f1d37c083c1069e95e253ad80c25e42f5624f6824bb1f4ce826
-
SHA512
472787c8827cb5df1c527caee6bb0766429a096f3931f30d7a435d891a0741b333c16000ae53cf1bb2398ba77187c5ae240145b30f51899bff074232e7f900b5
-
SSDEEP
1536:O3Wakjwa5CkyoH+p5nyn3nuC7XJ9Mje5rxLtLEc9Eccdk5GGA93EpjjMe61BW+pi:r8y0e5rxLtLnXLDMJLWFXG3yvD
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\SoftForum\XecureWeb\AnySign\dll\Any_setup.exe"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\SoftForum\XecureWeb\AnySign\dll\Any_setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name = "AnySign4PC" dir=in action=allow program="C:\Program Files (x86)\SoftForum\XecureWeb\AnySign\dll\AnySign4PC.exe" enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-