Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
07/08/2024, 01:15
General
-
Target
Document 240000807.exe
-
Size
1009KB
-
MD5
2fc319277fc5b4a422ee4061a9efb654
-
SHA1
21d125d5fea94d4a12327777fe209f50588fc82f
-
SHA256
94234a613eee42af83965884973b29b57e30ef77106535fd6b3b1efb9d7f2ae3
-
SHA512
76a5e5db7b6b1a8556f89caa0a76511ff0f6d2d3acd62e7ae2105b6a3b479e6145b800b49ac93844a8582eb2c67337368a08887a0899da7bb83a80ad514fd6d9
-
SSDEEP
24576:4tVbi/AS9oZaFzl37Btwo6sdKKFcLIF/gsuQ8u4k5TWkC6j:CViAS9oZCBt3dKKSy49WlWk7
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document 240000807.exe"C:\Users\Admin\AppData\Local\Temp\Document 240000807.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Document 240000807.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DUgZqfrTIHnoZO.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DUgZqfrTIHnoZO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7733.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\Document 240000807.exe"C:\Users\Admin\AppData\Local\Temp\Document 240000807.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57774b85f0710d669c9aa5f3b7c86b9b9
SHA137b1b95769caa1bfdcd9b50f7cece4b27596f90a
SHA2566166028d4abebacfb1adf25b5d24554118c7f622eed28dfd4339ba611250879e
SHA51250c6607eb541cf11b728c6bf20529073c83f774949054b7f825d6c099ffeb8f2ca1020a617a56aba37406c1f7355d04b79c10750e402bc76bd3921b256e435ba
-
Filesize
7KB
MD5cdec421f6c227791f301de1a68ffb34f
SHA19dd89a5db99eb3da87dd3662a3c17657910c0122
SHA256a676731df4c815835b6d45b911b081317712bcfe33cb53c1f4c3874e7c11eb5a
SHA5122a91e6e1707ce7f10220d081467aa69cce103bedd137777022de12b49929080a5b55bf7c0697a9887552757233032a04477c4298390f260ab5260a1c971f2f41
-
Filesize
6.9MB
-
Filesize
1024KB
-
Filesize
960KB
-
Filesize
6.9MB
-
Filesize
96KB
-
Filesize
56KB
-
Filesize
88KB
-
Filesize
600KB
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
4KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB
-
Filesize
332KB