Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 21:51
Behavioral task
behavioral1
Sample
872694eb1cd84ec743f5e3b9362e9c410fa4eb4c50a774a2ac09b190aca2e0d6.exe
Resource
win7-20240704-en
General
-
Target
872694eb1cd84ec743f5e3b9362e9c410fa4eb4c50a774a2ac09b190aca2e0d6.exe
-
Size
38KB
-
MD5
af0e1bf231901c5eb7c8eefec5efaa3e
-
SHA1
6b7d4379be9ed5343a7213461a6166ff03f81d6c
-
SHA256
872694eb1cd84ec743f5e3b9362e9c410fa4eb4c50a774a2ac09b190aca2e0d6
-
SHA512
293f8252bac31e064e82a2c9a9be1c3cb11e3ec578680cb89a5be6bfc471f1835e7f8322cd482a98ed2001c9ee587f9dc6936c1e12cac5b8183a3ea1168b1077
-
SSDEEP
768:kk/wI9Mer9KrSa6nh8+yT53QKFIQGAJb0WVui1KgduuLAnbcuyD7U+:X/wI9r9KOao8ZT5AKFJB+WVui1DAnou8
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Helloworld\Parameters\ServiceDll = "C:\\Windows\\system32\\259492952.txt" 872694eb1cd84ec743f5e3b9362e9c410fa4eb4c50a774a2ac09b190aca2e0d6.exe -
Executes dropped EXE 1 IoCs
pid Process 2900 Helloworld.exe -
Loads dropped DLL 4 IoCs
pid Process 2936 872694eb1cd84ec743f5e3b9362e9c410fa4eb4c50a774a2ac09b190aca2e0d6.exe 1956 svchost.exe 1956 svchost.exe 2900 Helloworld.exe -
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2936-9-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\259492952.txt 872694eb1cd84ec743f5e3b9362e9c410fa4eb4c50a774a2ac09b190aca2e0d6.exe File opened for modification C:\Windows\SysWOW64\ini.ini 872694eb1cd84ec743f5e3b9362e9c410fa4eb4c50a774a2ac09b190aca2e0d6.exe File created C:\Windows\SysWOW64\Helloworld.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Helloworld.exe svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 872694eb1cd84ec743f5e3b9362e9c410fa4eb4c50a774a2ac09b190aca2e0d6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Helloworld.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2900 1956 svchost.exe 32 PID 1956 wrote to memory of 2900 1956 svchost.exe 32 PID 1956 wrote to memory of 2900 1956 svchost.exe 32 PID 1956 wrote to memory of 2900 1956 svchost.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\872694eb1cd84ec743f5e3b9362e9c410fa4eb4c50a774a2ac09b190aca2e0d6.exe"C:\Users\Admin\AppData\Local\Temp\872694eb1cd84ec743f5e3b9362e9c410fa4eb4c50a774a2ac09b190aca2e0d6.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2936
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Helloworld"1⤵PID:2148
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Helloworld"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\Helloworld.exeC:\Windows\system32\Helloworld.exe "c:\windows\system32\259492952.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5c06467ed143ddfcbb01f0550cfac99bb
SHA18da840a6383a5b152e9ed72c1a1cd8a1ed774264
SHA2567315035a7e4b361b9dc7f60862aa82544e454fb525f533d4739bf5f48d4e12ca
SHA512b2e7b029626ad063a5a94607cff953d98b807b3c2ab258ed20fc6ddf8a65932b8c98f6adbe98bddf80d4bc53820e831c3709b66fcb9390579409e1ba99365788
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d