Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

14/08/2024, 15:44

240814-s6jgyazgqb 10

14/08/2024, 15:10

240814-sj92datfkm 10

Analysis

  • max time kernel
    19s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20240704-it
  • resource tags

    arch:x64arch:x86image:win7-20240704-itlocale:it-itos:windows7-x64systemwindows
  • submitted
    14/08/2024, 15:44

Errors

Reason
Machine shutdown

General

  • Target

    idapro.exe

  • Size

    327KB

  • MD5

    0ed74836af595a75d959e703e98f3735

  • SHA1

    f48fe1347528b1bcc210a90c60e93300ddfb1c31

  • SHA256

    3b14f10b8cd5c55d405785829bf2e8e4917fe1ac432ec0a376b2b4621314686c

  • SHA512

    dd5bb6e6c2674b8b2de6b22c0f7cc051303592d0fd50e14c8452988646760c907c9650e5b7ab594027e01faa9216f2b865b5ab015f34d92e62d51373f8152fbe

  • SSDEEP

    6144:UsLqdufVUNDa+anxutqrmxBpwrWlTKh4Qffn2n:PFUNDa+axuS+waZ84

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\idapro.exe
    "C:\Users\Admin\AppData\Local\Temp\idapro.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2724
    • \??\c:\users\admin\appdata\local\temp\idapro.exe 
      c:\users\admin\appdata\local\temp\idapro.exe 
      2⤵
      • Executes dropped EXE
      PID:2804
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2788
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2624
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2652
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2668
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3036
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 15:46 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1524
        • C:\Windows\Explorer.exe
          C:\Windows\Explorer.exe
          4⤵
            PID:492
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe SE
            4⤵
            • Executes dropped EXE
            PID:2888
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0
      1⤵
        PID:1728
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x1
        1⤵
          PID:2460

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\idapro.exe 

          Filesize

          192KB

          MD5

          05d5875e19e172b49adc9d0f04ccae46

          SHA1

          c2f617a38218ed18ac5350416789de87ccfa4606

          SHA256

          c595e3530c8f93a8021ef1e23ce9031c1a989cda64dc9b51e8ee49ceec4e275c

          SHA512

          311cbd9eb728b42122b6d7e44c6a2dd5299c664fda3119e7c88adb12d1e42f9a347d330e1bd5999391c7fa5870a0ce6a712b7274a688c1687d666a04998bf7a8

        • \Windows\Resources\Themes\explorer.exe

          Filesize

          135KB

          MD5

          97fb807872b1491b1b651ca01b7b44e5

          SHA1

          2a1c76699e60f4c68bfbcddb4fdf7bb0c03c2022

          SHA256

          2c817462143f75605819bda44f7086aaad80e798e3445e275afa34a834cc539f

          SHA512

          12ff80d7b1bcbf9df88aa767bdd093f98cc293092325fae4a4967a9a497678b84a9828069ce5abbbbf4fbcc2751fbfedf8c3ace84b7e52fd003f369ecb1c40f5

        • \Windows\Resources\Themes\icsys.icn.exe

          Filesize

          135KB

          MD5

          86ffadfb7aede1665b2cc6824ca7e0b7

          SHA1

          4cf1e686c88b44e0becc99714cccdc97bf05483b

          SHA256

          e599fc27c331701c45cc4384465da66c050dcfd999ee9e0ab17143bff7d8ce18

          SHA512

          a40e176b749502e1b8d95791d98bf11641adbfec09586189452c9c9e0aa9f52e66f125972503a9b6f82615f95bb3045c1798939a1a3b3e79b932fa9987c1d74f

        • \Windows\Resources\spoolsv.exe

          Filesize

          135KB

          MD5

          1bc1a081ec2bed4975fee76d840302e3

          SHA1

          8934e6391e0af1bf4c3813e29e3dea50d1dc425e

          SHA256

          ef5215df85ff8c6538e06f0130b19134aab2ad2b9552a63ddb4dad62d1e995ac

          SHA512

          4d9ed09fe89d765244e71f6a612870a38c901458ede7213935c2261a9303165652b51f63e6101a8cea70b4163213c5879ec6b6c76cf4e82200d54996f9e32373

        • \Windows\Resources\svchost.exe

          Filesize

          135KB

          MD5

          2e96e615382bd6905f8e8a31d2237503

          SHA1

          227ee3c93c2cc2c08ace0ca3379dbe6582bbcadc

          SHA256

          bddb2f1c4187c2d695bbe28486d027947fddf58244ac6634df29554e4c60598f

          SHA512

          660ac75eac6f17ea7547fa9beca5ec3eb9926d724c82238682e6852f5c070657dd5f5be46bb68cd4d828abe3f87fa1d0f0d4b80c918774641c0322e3a962c628

        • memory/2624-66-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/2624-65-0x00000000005D0000-0x00000000005EF000-memory.dmp

          Filesize

          124KB

        • memory/2652-44-0x00000000003E0000-0x00000000003FF000-memory.dmp

          Filesize

          124KB

        • memory/2652-59-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/2668-49-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/2668-54-0x0000000000290000-0x00000000002AF000-memory.dmp

          Filesize

          124KB

        • memory/2668-62-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/2724-0-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/2724-61-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/2724-14-0x0000000000270000-0x000000000028F000-memory.dmp

          Filesize

          124KB

        • memory/2788-60-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

        • memory/2788-25-0x00000000003C0000-0x00000000003DF000-memory.dmp

          Filesize

          124KB

        • memory/3036-58-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB