Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
27/07/2024, 02:37
General
-
Target
829218b71ff5d0d3ebaf12fff9d22f10N.exe
-
Size
68KB
-
MD5
829218b71ff5d0d3ebaf12fff9d22f10
-
SHA1
849ebec8d74753de0b1503a3ad26b131d4b90217
-
SHA256
596589d198fd9c9a0652aee91e8567ed7084303cf9ba2d5e22a6704a31402d2f
-
SHA512
e7774363ea2f9f9db48bb1cb733b9e846bee686ff5442a5c43b57a9846d708db1be615e2775974f09244c41b8bf7c90b91b9f517c8f6db858f23583dd5594bc2
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1HwQYG:ulg35GTslA5t3/w0
Malware Config
Signatures
-
Windows security bypass 2 TTPs 4 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Windows security modification 2 TTPs 4 IoCs
-
Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
remove IFEO.
-
Modifies WinLogon 2 TTPs 5 IoCs
-
Drops file in System32 directory 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\829218b71ff5d0d3ebaf12fff9d22f10N.exe"C:\Users\Admin\AppData\Local\Temp\829218b71ff5d0d3ebaf12fff9d22f10N.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\omkuheat-ousid.exe"C:\Windows\system32\omkuheat-ousid.exe"2⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\omkuheat-ousid.exeùù¿çç¤3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
68KB
MD5829218b71ff5d0d3ebaf12fff9d22f10
SHA1849ebec8d74753de0b1503a3ad26b131d4b90217
SHA256596589d198fd9c9a0652aee91e8567ed7084303cf9ba2d5e22a6704a31402d2f
SHA512e7774363ea2f9f9db48bb1cb733b9e846bee686ff5442a5c43b57a9846d708db1be615e2775974f09244c41b8bf7c90b91b9f517c8f6db858f23583dd5594bc2
-
Filesize
70KB
MD599262ab3f20215bd92ce28a20dbc0c52
SHA1781694624515bb29324b1663dc089e0e883c4cba
SHA2562f20b4a6b2651c8fcd56cdbdc04617f3953246e86a954e58678d7cc3a325218c
SHA51205b96875c2386c6e654c8e56f19704f2e75bea44bb7dbc84dec49cc373e61d715aed3f0e6f5094b41e11e32f076c4c0fe99d887434972608ab7c69cd6d2210c7
-
Filesize
71KB
MD5d9c6f878503c3f9d309e37d7045eec45
SHA1d2b3979ea28ca7766754a3b573827a61bb82815a
SHA256e2c63209a3ae8961bf4b2c6fee12c67773df1ca069b43548266483ea7b4c4e90
SHA512bb60a836a56bd426c65f5d9d9e94b6a15f75d94c8bb1cb379a22ffaed1c243fa35aced6c5810dbb0ffb9db73f4ea6e6f8cd47a49832e181e1bafb69f9bdb782b
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB