Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
21/08/2024, 15:30
General
-
Target
dfcb72df9d7365a74214073b7006d9a0N.exe
-
Size
209KB
-
MD5
dfcb72df9d7365a74214073b7006d9a0
-
SHA1
6d1b58acc1fdf1961c6ec807c669e67684d93b4f
-
SHA256
74550647b3a5e08fb3ffaeb4444beeea3e86312919a7e7350008062aeeac37e3
-
SHA512
35b143b4bd084634c40f517b92f0843a725553064be5cf167d52f5ad099407d56540885811b163bf861908df587973179f6d05933141efd612b5704ed43607f7
-
SSDEEP
3072:0Qcjk9tVRNIcjb4Ryfjijjx14hdeCXHKPJFo9zpE7Di0X0JuLL+o7BlpF9e:0Qh9tVRm2kh34hdeCkcG7DEALLlnN
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfcb72df9d7365a74214073b7006d9a0N.exe"C:\Users\Admin\AppData\Local\Temp\dfcb72df9d7365a74214073b7006d9a0N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5c4772e28c4d10f1f2bb655fa3f621c11
SHA167637f6132d0786e63610c17cb8d89b64cc03404
SHA256565fa9b92ce14c18f01ddff45549b87a8c855ad1058843dd228d467931959ff2
SHA5126c82f903712c957cf95b7f34508e30079aa2eef93e4e74acdb044dfd27c57b1550012a49baa4958a1cfe18b48b1d973308673ec15c766d50dd948e8c60b08f73
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
552KB
-
Filesize
552KB
-
Filesize
612KB
-
Filesize
420KB
-
Filesize
552KB
-
Filesize
612KB
-
Filesize
552KB
-
Filesize
352KB
-
Filesize
420KB
-
Filesize
352KB
-
Filesize
420KB