Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 23:17
Static task
static1
Behavioral task
behavioral1
Sample
7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe
Resource
win7-20240729-en
General
-
Target
7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe
-
Size
811KB
-
MD5
c45b66bee5186dcde515806ce4a6126c
-
SHA1
9dca8c82de44c2b74a1773148df5a66d4bb346cb
-
SHA256
7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d
-
SHA512
a830b660b39856e21387c4e615b5c144d64d7e892d61761225ec581a234199bffceed9c9862c12d51ebc30e01774db88edab42368301796fe85b84aaaf2eb019
-
SSDEEP
24576:5uvKArV++kdWK5BqQESn/UsoLCfrG5ZpDv6z:5+pASK5UQES/PST54
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4572-2-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-6-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-5-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-7-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-122-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-124-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-129-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-125-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-123-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-130-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-131-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-134-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-133-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-138-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-139-0x0000000002290000-0x000000000241E000-memory.dmp upx behavioral2/memory/4572-180-0x0000000002290000-0x000000000241E000-memory.dmp upx -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4572 7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe 4572 7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe 4572 7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe 4572 7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 4572 7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe Token: SeCreatePagefilePrivilege 4572 7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4572 7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe 4572 7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe"C:\Users\Admin\AppData\Local\Temp\7f2489b6843ff62bcc9c0778087ce8067c849b507cae902978e78acd852f286d.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156B
MD51ea9e5b417811379e874ad4870d5c51a
SHA1a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
-
Filesize
9KB
MD597da200584d89aa846ab80a9c6089d15
SHA18f8b26d276f09d8a6a3021db8691c59e27d4a23f
SHA25634f6cf64e8fce88f542fe5e28a3af4a75b342a2b0c491ff15d60be3ec67f53ba
SHA5128bca3027cf5ef8fc12011a840af113ef23253000aa4367a8255e03875bf2e82e4095fd86b88585f4f1b21489f53ffb5527cf91eeb455c178e86b5dc8a39e4171
-
Filesize
506B
MD55335f1c12201b5f7cf5f8b4f5692e3d1
SHA113807a10369f7ff9ab3f9aba18135bccb98bec2d
SHA256974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
SHA5120d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df
-
Filesize
24KB
MD5c8f42acaaffb00e522d197917855e068
SHA15d5a663538312543687c2b3e4d0fa08e54282a24
SHA25657869e6d0390761fea566d34cab74019600f8a14e3c0943a2fa0265e97e7f860
SHA512c5d916ee2b94ef8f60b2cbb341042f6f6abf9930a4108ed4bad24ec39ab990df8ab903816c34a53502d5607e989e5e756049541b472fff97b98b7a84c3b8597a
-
Filesize
207B
MD5c222a4f3d309721c0898606960120266
SHA1cdee967961a3ea87565ae7ca287be8ed20496160
SHA256f638cc042b7ade6f43f2faf0077e020137562e559178396b7e975db39ac13df6
SHA512db52224964ffd03fa65fddabea29d4f7c23840a18d1ad1028f228589c8c642280a762d2f4250159106f911455b8f0706a3b204dcbbb0484638d4f41f4f54a836
-
Filesize
808B
MD5ccfbcbb51598a1946b19ff56c4ae9bd1
SHA183c5a77c766253d2c22e3b893408fe60acb46113
SHA2567ec494b43d8c70c338929fd88af752e117bb924a4284b93567e7b8c9cb79be9f
SHA5124a7b08a008350460beeb60e9473e497ab1c67d5ef60e927bb35a8cae574fd177b2c1a8e2df26d655e28b4ec4726d5616938ed4a612cbfcfa8f52f82d0de94426
-
Filesize
698B
MD5124bc01ea52af57ca245837d87460f4b
SHA1d2726285b847e7d43c937f304b16b2cbce059662
SHA256f12fd05169348634a4fead731020fea3b9db80a1b1738b5db8488b45ef480475
SHA512e2f9006f8a0126ef9927a502dc1088a60af1fd36bd64deb5193e5abe2beaaeeb3c0bc47135070d7aa949205df592221e7b0bc62c3b5c420b59778b0dafa498ee
-
Filesize
10KB
MD557ca1a2085d82f0574e3ef740b9a5ead
SHA12974f4bf37231205a256f2648189a461e74869c0
SHA256476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
SHA5122d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c
-
Filesize
577B
MD584b37cb510f50c8fea812eb308d3f03f
SHA1d141a79feb407506709f051e55c55438a12fd3b4
SHA2567bf800336671204de36b7d1f6ceffdff830040f51d21bc44f220f68d72cf492b
SHA5123222cb5772a4e9b20de253914c0856c7e6383567df68fcf287801f6f79248f65957515e7ec4a44db1fbe910afeae8ca3349295c4bdf03df6aabde36f2aaa6b5e
-
Filesize
2KB
MD55995603e376b72b3f2f02d400b44584a
SHA14127535df235428d157f83006fa23225130215ce
SHA256392d2b22da905e8f2092d96116b6aa3326dbede98fc6f0c45e5b9146f9fc2f48
SHA51274aa387e04e79fab7b6ce570acada3d0cb882f440999f3539caf7bbd9ec505765d9b6b39cea5edfdb176b17186b302f21dcf059dc03ed0045a81595c9947a861
-
Filesize
1KB
MD541e2db8679de78b2a15a5ada20c0228f
SHA14e0cac7678928d838a61bf171c496b922c121f00
SHA256cbd36783ed6c4a4bae2414f76102032fcd0905b911c5596014ed0d14c5685b7a
SHA512aad04e4fd9ff2d90bbee9231b0c095f350393703c3e10351bafc1160896c30d0d3ed5f616bd9820742aed4295a698af392f6106995492bb532d0163d557642b2
-
Filesize
221B
MD507cd59b954e8495ad6cd6a7c11d2de86
SHA1787aeda3eee8053705fb208a6b399b8340820b82
SHA2566e6b964fd79b4a3461f128e2ed145b9b641d108b8616695f36387661cae995bb
SHA5120159aca0c2a49393fd91acd4b6819217e67f8fd01e220297eb3e0fdd8132fad794fc317f5cc5e2b761d4123da71478b97df776908de6740eb6d54187c6c00754
-
Filesize
718B
MD59d31583bcfad58a6b9ddeaf44549a5e6
SHA198f4c693af708e02201de2aee31fe094dc3b0a9c
SHA256e466a2db2f755d9eb68619439af37ff4e45559b7a3f476e226ab2a11aeadae1a
SHA5129ddaaad53375f4d2874fe5c98b6782202d2bd975cdd9363796986dc7567368b94d9ec1aa3e839194097838b787bbd71d574540cf5b04fd04f10fa80d6a89e695
-
Filesize
19KB
MD570e70599d4b853df0f12f6cb0e04695f
SHA16e3a721aef65625bf99b639800476150d262dd4b
SHA25687af4027e8f89459463bdd73df7b928b883eefb20514159d3a1a4be0d39e00c0
SHA5121efcf8af09cf857b3850cec43a88fc8c0992e3b04f78ad2c71b84c2ac7775e745df211582694588b29217aefb1ae02b29b94c2cfe52b5d32bdafb9dce73b9920
-
Filesize
27KB
MD51cc2677e3e29e45e538985839cff2b42
SHA12dab653eb20be72b034a38dc1fcebbd18f079c86
SHA2569216d98a6574dfadacdc8321dc435454cb72c589b3ee8326a9b946966f756d7f
SHA51225575fea9abb1491b5a5853244a9b655ce05f64d98f4b79134674f2d9a560a5af405c1783c9da4a07cfb38b51d060c7a70890c70df6c1c8f4b01e041aa4f649f
-
Filesize
2KB
MD5e3758d529f93fee4807f5ea95fbc1a6c
SHA13a9a1ba234e613e5f808c3ffeda05a10a5dafe00
SHA2568d46eb0c60043dcb7d79ab3d0525148fc901764620c02e4b9c5dd8b0e9026303
SHA512e891552bee3aa10247cad1fcc510331077016a6e71d46827be2dd46017f943c5acc2c1506b41217880d35d52a94989923ad0a345f8791da4bb379eceefe3c407
-
Filesize
1KB
MD59949492ba54aee4340b57282e05a978d
SHA1bed6e0f47e77858d54178467e15a0829fbade193
SHA2568721078a45e67b58a01633cf207467ad7c096a0cf23191ebbe3660c8256bb695
SHA512f2e5adebf9d3c74c0adb5246ec5880be05ee265844afef3eb1ee92a8c26db273f15c8a534fced1485dca61ad2f96d1c625645172b44f34388d3a6afa0efa4414
-
Filesize
2KB
MD5124a1c75e2a701c46ad1ae65597704a9
SHA1dc39492573cad0f9f80ee9d6d8118ec76bbb946f
SHA2560b4187399a0a83dd7155dd6ac6deb1b1e244c7dd92683d8f04e2c9a3e683e945
SHA512dcd14b7d54b59179cce9e9394d3b1dce63f574de311f03ec4a6a879fa6833bac602113be865496ae7e66c4dbd2ab8daeb11495e15e4b6d6016e657f0ee53adcf