Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 06:54
Behavioral task
behavioral1
Sample
a438e3504baad6b28ae8d3da613bf6d0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a438e3504baad6b28ae8d3da613bf6d0N.exe
Resource
win10v2004-20240709-en
General
-
Target
a438e3504baad6b28ae8d3da613bf6d0N.exe
-
Size
29KB
-
MD5
a438e3504baad6b28ae8d3da613bf6d0
-
SHA1
69655187018588d39438506633ae3566c6e7ce09
-
SHA256
f06540c0c8662e616ed0fb929930935e62155a73cd8775da871bd4ebf5a2a24e
-
SHA512
1e38c54c049fd945c8cded5978ce5d997479ed2712ae662652143bae98ac573b8ae0668051dcca65e173e7ebb13fcba0b15f706b307cf4781fe72e1d8207bc96
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/wtsj:AEwVs+0jNDY1qi/q2sj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1728 services.exe -
resource yara_rule behavioral1/memory/2172-0-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/2172-4-0x0000000000230000-0x0000000000238000-memory.dmp upx behavioral1/files/0x0008000000016d81-7.dat upx behavioral1/memory/2172-16-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/1728-17-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1728-22-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1728-29-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2172-30-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/1728-31-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1728-36-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/files/0x000c000000016d89-49.dat upx behavioral1/memory/2172-54-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/1728-55-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2172-56-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/1728-57-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2172-60-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/1728-61-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1728-66-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2172-67-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/1728-68-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2172-72-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/1728-73-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" a438e3504baad6b28ae8d3da613bf6d0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe a438e3504baad6b28ae8d3da613bf6d0N.exe File opened for modification C:\Windows\java.exe a438e3504baad6b28ae8d3da613bf6d0N.exe File created C:\Windows\java.exe a438e3504baad6b28ae8d3da613bf6d0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a438e3504baad6b28ae8d3da613bf6d0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2172 wrote to memory of 1728 2172 a438e3504baad6b28ae8d3da613bf6d0N.exe 29 PID 2172 wrote to memory of 1728 2172 a438e3504baad6b28ae8d3da613bf6d0N.exe 29 PID 2172 wrote to memory of 1728 2172 a438e3504baad6b28ae8d3da613bf6d0N.exe 29 PID 2172 wrote to memory of 1728 2172 a438e3504baad6b28ae8d3da613bf6d0N.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a438e3504baad6b28ae8d3da613bf6d0N.exe"C:\Users\Admin\AppData\Local\Temp\a438e3504baad6b28ae8d3da613bf6d0N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5a438e3504baad6b28ae8d3da613bf6d0
SHA169655187018588d39438506633ae3566c6e7ce09
SHA256f06540c0c8662e616ed0fb929930935e62155a73cd8775da871bd4ebf5a2a24e
SHA5121e38c54c049fd945c8cded5978ce5d997479ed2712ae662652143bae98ac573b8ae0668051dcca65e173e7ebb13fcba0b15f706b307cf4781fe72e1d8207bc96
-
Filesize
352B
MD5d633eb86439fbc8b1adce7c7ab79bddd
SHA1788f4f83009f4b432c56bf0ef48b5326798dd006
SHA2560d7d0b57693984609c35feb7195d710f795ab3548f9737df1619102dc7e3e77d
SHA512b5bf71fd8f4da111a5d1a08b4a249ec11e601a88a90e394005326f4e2d821971b6dc6fba2b6d3277dca5e3116df488b56d401563ca1e8a15eb36ff0ee2ef551e
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2