Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
17/08/2024, 00:41
General
-
Target
74f585ada49b89c894a0a2208ab7a97d6b331fe04ce2fbfd2d69bd81f27f26f4.exe
-
Size
204KB
-
MD5
fec01093a986eca421cf16fe305b8fdc
-
SHA1
aeebb8899aa298bf8a949369f0fe122223a83149
-
SHA256
74f585ada49b89c894a0a2208ab7a97d6b331fe04ce2fbfd2d69bd81f27f26f4
-
SHA512
066fb3ed08b16aa01f0a21ad2661c1ce7cda7c3eb817037a4fbf9be068224d37157406ee9336d2c83ca3e01830d8d6553b893cf7353c32836fc53dda578b7b9b
-
SSDEEP
3072:Q5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:QLexkuRaX41xoyJV65gzyZko+uc
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74f585ada49b89c894a0a2208ab7a97d6b331fe04ce2fbfd2d69bd81f27f26f4.exe"C:\Users\Admin\AppData\Local\Temp\74f585ada49b89c894a0a2208ab7a97d6b331fe04ce2fbfd2d69bd81f27f26f4.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5a0e74b88a9dbc7fcb800f3d871db5b48
SHA18f125a37cbb12cb480d9df0e401c898a7cbd2a1a
SHA25613e060a7921934e1e75f55da896902198d4abf964310e47c04cb98d413a2c673
SHA512562f5b3cca1df3bf907a65c3541e30a41b85cee085048013fed00f6389fc04e809e9120997173af15a0d5483bca095bd9211b3fa65b72d87c1053012cfdae1e3
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
204KB
MD59f49f91d6e396298643b56fcb31b955d
SHA1a030abb32aadfc2b0babdefbfe3f0dad3336d2f9
SHA25688e711523cabd5c464f1e7c3978f33432077b9e730ec11ac3343028baafded5e
SHA512a128ccce86fc2909bfe362ed27abe1c483a47b7589aa86476765fc8871e571cbdceae4ada80149094f5705530f7351356b0ff12a48f8c0794a0af25398574d7a
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB