Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 09:19
Static task
static1
Behavioral task
behavioral1
Sample
422cb26a147b61b4c0c35b605cfdeb70N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
422cb26a147b61b4c0c35b605cfdeb70N.exe
Resource
win10v2004-20240802-en
General
-
Target
422cb26a147b61b4c0c35b605cfdeb70N.exe
-
Size
211KB
-
MD5
422cb26a147b61b4c0c35b605cfdeb70
-
SHA1
c3e2bb8274bab51c49a90f997151d1678a8fe1c9
-
SHA256
b9761fe14ffb685403f490608933c0a1d0756b31f21821f50f09d10b76cf161e
-
SHA512
075cb8271428a4b58038102c50d67e2b286b24c5af6fa3b4997cb3c8448e17ba17d053aac382e602ace4555af6ae04d407c489b3f0cec065c959eab6626fbc57
-
SSDEEP
6144:EmKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3:+71YpQiU/RcO1VQInVob
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2972 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 2516 422cb26a147b61b4c0c35b605cfdeb70N.exe 2516 422cb26a147b61b4c0c35b605cfdeb70N.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\26e4160b = "C:\\Windows\\apppatch\\svchost.exe" 422cb26a147b61b4c0c35b605cfdeb70N.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Defender\vocyzit.com svchost.exe File created C:\Program Files (x86)\Windows Defender\vonypom.com svchost.exe File created C:\Program Files (x86)\Windows Defender\galyqaz.com svchost.exe File created C:\Program Files (x86)\Windows Defender\gatyfus.com svchost.exe File created C:\Program Files (x86)\Windows Defender\pupydeq.com svchost.exe File created C:\Program Files (x86)\Windows Defender\qexyhuv.com svchost.exe File created C:\Program Files (x86)\Windows Defender\qetyfuv.com svchost.exe File created C:\Program Files (x86)\Windows Defender\lymyxid.com svchost.exe File created C:\Program Files (x86)\Windows Defender\pupycag.com svchost.exe File created C:\Program Files (x86)\Windows Defender\gadyciz.com svchost.exe File created C:\Program Files (x86)\Windows Defender\galynuh.com svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\svchost.exe 422cb26a147b61b4c0c35b605cfdeb70N.exe File opened for modification C:\Windows\apppatch\svchost.exe 422cb26a147b61b4c0c35b605cfdeb70N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 422cb26a147b61b4c0c35b605cfdeb70N.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\MuiCache svchost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2972 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2516 422cb26a147b61b4c0c35b605cfdeb70N.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 2516 422cb26a147b61b4c0c35b605cfdeb70N.exe Token: SeSecurityPrivilege 2516 422cb26a147b61b4c0c35b605cfdeb70N.exe Token: SeSecurityPrivilege 2972 svchost.exe Token: SeSecurityPrivilege 2972 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2972 2516 422cb26a147b61b4c0c35b605cfdeb70N.exe 30 PID 2516 wrote to memory of 2972 2516 422cb26a147b61b4c0c35b605cfdeb70N.exe 30 PID 2516 wrote to memory of 2972 2516 422cb26a147b61b4c0c35b605cfdeb70N.exe 30 PID 2516 wrote to memory of 2972 2516 422cb26a147b61b4c0c35b605cfdeb70N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\422cb26a147b61b4c0c35b605cfdeb70N.exe"C:\Users\Admin\AppData\Local\Temp\422cb26a147b61b4c0c35b605cfdeb70N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD5a34297a690d40ad6fbec79dd7c85083d
SHA13b581d5fb074d63fa9fdd4a784a082cedbd201d2
SHA2564cbd752825ae18b49204912b46ba9e24b0801d229a0626aadea7e4b37289948a
SHA512663239c8b4bdc53ed0aa4178e094f2fc65a76339fa0d5fe947a04c83582d7161d89cf8dff6731538a28ceba3ce998990de7411ca6df5830386166165a5445c06