Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 15:30
Static task
static1
Behavioral task
behavioral1
Sample
dfcb72df9d7365a74214073b7006d9a0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
dfcb72df9d7365a74214073b7006d9a0N.exe
Resource
win10v2004-20240802-en
General
-
Target
dfcb72df9d7365a74214073b7006d9a0N.exe
-
Size
209KB
-
MD5
dfcb72df9d7365a74214073b7006d9a0
-
SHA1
6d1b58acc1fdf1961c6ec807c669e67684d93b4f
-
SHA256
74550647b3a5e08fb3ffaeb4444beeea3e86312919a7e7350008062aeeac37e3
-
SHA512
35b143b4bd084634c40f517b92f0843a725553064be5cf167d52f5ad099407d56540885811b163bf861908df587973179f6d05933141efd612b5704ed43607f7
-
SSDEEP
3072:0Qcjk9tVRNIcjb4Ryfjijjx14hdeCXHKPJFo9zpE7Di0X0JuLL+o7BlpF9e:0Qh9tVRm2kh34hdeCkcG7DEALLlnN
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2328 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 2352 dfcb72df9d7365a74214073b7006d9a0N.exe 2352 dfcb72df9d7365a74214073b7006d9a0N.exe -
resource yara_rule behavioral1/memory/2352-1-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/2352-17-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/2328-19-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/2328-31-0x0000000000400000-0x0000000000469000-memory.dmp upx -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\8605f82c = "C:\\Windows\\apppatch\\svchost.exe" dfcb72df9d7365a74214073b7006d9a0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\8605f82c = "C:\\Windows\\apppatch\\svchost.exe" svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\svchost.exe dfcb72df9d7365a74214073b7006d9a0N.exe File opened for modification C:\Windows\apppatch\svchost.exe dfcb72df9d7365a74214073b7006d9a0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfcb72df9d7365a74214073b7006d9a0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe 2328 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2352 dfcb72df9d7365a74214073b7006d9a0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2328 2352 dfcb72df9d7365a74214073b7006d9a0N.exe 31 PID 2352 wrote to memory of 2328 2352 dfcb72df9d7365a74214073b7006d9a0N.exe 31 PID 2352 wrote to memory of 2328 2352 dfcb72df9d7365a74214073b7006d9a0N.exe 31 PID 2352 wrote to memory of 2328 2352 dfcb72df9d7365a74214073b7006d9a0N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfcb72df9d7365a74214073b7006d9a0N.exe"C:\Users\Admin\AppData\Local\Temp\dfcb72df9d7365a74214073b7006d9a0N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5c4772e28c4d10f1f2bb655fa3f621c11
SHA167637f6132d0786e63610c17cb8d89b64cc03404
SHA256565fa9b92ce14c18f01ddff45549b87a8c855ad1058843dd228d467931959ff2
SHA5126c82f903712c957cf95b7f34508e30079aa2eef93e4e74acdb044dfd27c57b1550012a49baa4958a1cfe18b48b1d973308673ec15c766d50dd948e8c60b08f73