Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 02:18

General

  • Target

    532ad1dca5ee84d4e717c45b39bb5480N.exe

  • Size

    135KB

  • MD5

    532ad1dca5ee84d4e717c45b39bb5480

  • SHA1

    e4fde9f8d9499513ddeda2c5a786592394358b5d

  • SHA256

    a8610c46777dbdebb6813199f19ce94a3b225f6f69326985854d9cdde68f04ae

  • SHA512

    e57a419418a9c3bd3167a1beed0dae4c42df99a4e0e4c7fef5c4f93b8c25d302441f7069bd33da5362d8a2da033e166f189bf86a0c36467cf263781bcb2cd526

  • SSDEEP

    1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVA8:UVqoCl/YgjxEufVU0TbTyDDali8

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\532ad1dca5ee84d4e717c45b39bb5480N.exe
    "C:\Users\Admin\AppData\Local\Temp\532ad1dca5ee84d4e717c45b39bb5480N.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2636
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2800
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2832
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2828
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2700
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:20 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2976
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 02:21 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2596
      • C:\Windows\Explorer.exe
        C:\Windows\Explorer.exe
        3⤵
          PID:2604

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\spoolsv.exe

      Filesize

      135KB

      MD5

      5657472f50ffc45196e93599885d192e

      SHA1

      929642867822da5e2bdda36125c9d5d2c85e3a35

      SHA256

      9e53cd46156cddb4ad88d0fcb0ed1bbe21c53e1743cdf102cd1423a2a2a858c0

      SHA512

      c73708c59dffbda0c1a000cc8c32b41501748086caafb5c1624c938358a0489819adef3509d4258a61c986775a2e8751a1e666e3ec7efbcf06058ae86586f60e

    • \Windows\Resources\Themes\explorer.exe

      Filesize

      135KB

      MD5

      786750dbc9724b546a986163ddd3d989

      SHA1

      94b909adcbb0132176146c71054207df276dc4c5

      SHA256

      ff54d36af3b0feb1cded2f1b7a5a14834d49a15b71fedbb0942f562b52db4fc7

      SHA512

      f778e8ab8583a6048e88a4b03e6e58f6e08ab29244aea30cdf549d5c7d30bb9ca82025fec5b05974f345380d8f771a4c8ca2176baf35a36b1db2b079e19a290f

    • \Windows\Resources\svchost.exe

      Filesize

      135KB

      MD5

      fabc42918a39e2fb79d68c33a92d60e6

      SHA1

      d026b84720d3e5f603cfb6d181eb09d5ad659a26

      SHA256

      3702b8f63d23f2372e0189a4c6198ba4f2bdf292834c3c36f23505fdc629e9fa

      SHA512

      52b4777b382840694f6a866b96133751d3175e807bbcf1b156142e6e8b421a530b33070411be8222be4c77fa0fde5298aec349d13bd6cdd925452358369cf1b1

    • memory/2636-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2636-42-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2700-40-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2800-43-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2828-35-0x0000000000450000-0x000000000046F000-memory.dmp

      Filesize

      124KB

    • memory/2828-44-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2828-45-0x0000000000450000-0x000000000046F000-memory.dmp

      Filesize

      124KB

    • memory/2832-41-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB