Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
02/08/2024, 03:37
General
-
Target
4c16c5a6200165d3cf90a5f645e26ab0N.exe
-
Size
212KB
-
MD5
4c16c5a6200165d3cf90a5f645e26ab0
-
SHA1
b35f2c6730414ee91dfbe6c410dc04bf0d146196
-
SHA256
a4e303fb9284ffcb108ad545f8f7203cf796aa1a02f906ba45a6faedea8390e8
-
SHA512
7269a0b03613fd7666ea599fb34160ce13e462914e6ad0a97f3ecc49ae254472fcf18b52859edccd04d7d0e62289aaa05ef575c0be80fb2176d4123e5000673e
-
SSDEEP
6144:zob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4G:EboEj/8ASWM4Ki96/zqIKG
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c16c5a6200165d3cf90a5f645e26ab0N.exe"C:\Users\Admin\AppData\Local\Temp\4c16c5a6200165d3cf90a5f645e26ab0N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD58831dce1c5d5045885f00f8d1b418fca
SHA12265ce4e1764dfef31218fd9d0f5d4c0225e4af7
SHA25614c38e515edbce63b2268e913ab7ef7e35d4aef505e5a793cb81065cd32bad79
SHA5125561c3a3e4010779a1bcb86a83e14d066b00d6731bafe0a74eaede508c41988fcdd4ccfb47384f9f56472a35e80f68eb14fbd80ac46579de65dd23ec1dd3febf
-
Filesize
212KB
MD5373d86b4f86fbc94755c48eaf068b4bf
SHA11ce8bbcce56369bc162d848435b93b0d72bdb8ea
SHA2565071cc907a722a5624d015e4c20591acf50e501f409ad4a4344894e12478a52e
SHA5125aa85440558d6d3109fde71a57cd4520ceb537438d6cb412d145b682aac77de605b78ec884bee4858627d3e85f38996195bdc31fd40312bcca620b7f79524a1d
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
1.7MB