Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/08/2024, 03:55
Static task
static1
Behavioral task
behavioral1
Sample
5dd8f8ea335570f4a2d9acf621bb43a0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5dd8f8ea335570f4a2d9acf621bb43a0N.exe
Resource
win10v2004-20240802-en
General
-
Target
5dd8f8ea335570f4a2d9acf621bb43a0N.exe
-
Size
40KB
-
MD5
5dd8f8ea335570f4a2d9acf621bb43a0
-
SHA1
4406d9d4ff1eb6dc98439ae6beac567fc30ccb7c
-
SHA256
8d031b8a04e58f331437dc11e8f7da6cf5ed407f4dcdceb50cbde8c4eb0b2cba
-
SHA512
a67505c1516b62be481aef4783873fdea6a2f1e61efef9d3f66d19e42a83c902841b9336ea2a25e6fad778aba47f6a7b2bbd2f5c1ebbbb9c25448476bfda9884
-
SSDEEP
768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhP:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYv
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2484 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 2484 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 5dd8f8ea335570f4a2d9acf621bb43a0N.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 5dd8f8ea335570f4a2d9acf621bb43a0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dd8f8ea335570f4a2d9acf621bb43a0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2484 2272 5dd8f8ea335570f4a2d9acf621bb43a0N.exe 30 PID 2272 wrote to memory of 2484 2272 5dd8f8ea335570f4a2d9acf621bb43a0N.exe 30 PID 2272 wrote to memory of 2484 2272 5dd8f8ea335570f4a2d9acf621bb43a0N.exe 30 PID 2272 wrote to memory of 2484 2272 5dd8f8ea335570f4a2d9acf621bb43a0N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dd8f8ea335570f4a2d9acf621bb43a0N.exe"C:\Users\Admin\AppData\Local\Temp\5dd8f8ea335570f4a2d9acf621bb43a0N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:2484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5cab9a2a48fa97eb88a4bc5b1223a5808
SHA1593b928d0f94689cc9c78063bc85931550d0130e
SHA256586400b911a349dfd4694fbf06ef85af2ffae1a2d98f40e64199848ea6e9c3ad
SHA51243bcb973f9dfce721661b9d4e6a18907e33cd884607de9ca93aaf6dc17882389ad23a2e8a2c93222ee5255d4058719a2c911d6547b7311137a3cab1de72051d8