Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 21:42
Static task
static1
Behavioral task
behavioral1
Sample
fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe
Resource
win10v2004-20240802-en
General
-
Target
fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe
-
Size
37KB
-
MD5
fd8c83fbf34b0f39bdfd5c38fc91ae20
-
SHA1
540af4a5a46b67b5114f92c4f3f100254aa9bead
-
SHA256
4d7d9f8ed119b091130276f0b99a2a6a427ea66c77845c9fff907e414cd57c53
-
SHA512
124b5c446c73f7efcdf187d2b6cbb4117fa260d534ea25f247d94525aab0c7cf5fe45bfbe03eb5231a0b35137f6a86a5622a0ecf9ecaa0ab48b8b42a20b98ee5
-
SSDEEP
768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjU+Emkcy:e6q10k0EFjed6rqJ+6vghzwYu7vih9GL
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1508 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 1508 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 408 wrote to memory of 1508 408 fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe 29 PID 408 wrote to memory of 1508 408 fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe 29 PID 408 wrote to memory of 1508 408 fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe 29 PID 408 wrote to memory of 1508 408 fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe"C:\Users\Admin\AppData\Local\Temp\fd8c83fbf34b0f39bdfd5c38fc91ae20N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
PID:1508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD55d68884aea3debf17fbe95adb1ba9dee
SHA16cc5363b79f909789f4d6ae40d99cb435156d8d7
SHA2560065392ef1525df1d5184a89963718220c83ca115d9a15ea860ec93e57f13497
SHA512bc1bd7bd88884b0268757f6ce1f57cb8d03b92a8f27a219ace994b72912815c4c4c3810c28efdffe21c56ee2d54ce3a75472690d7c667ff17cde0b4201a6c6e8