Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
9713e4828cb213187616e0fb93bdb330N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
9713e4828cb213187616e0fb93bdb330N.exe
Resource
win10v2004-20240802-en
General
-
Target
9713e4828cb213187616e0fb93bdb330N.exe
-
Size
350KB
-
MD5
9713e4828cb213187616e0fb93bdb330
-
SHA1
2b1fc1a98e398cac76bfc236f9500870e2c4a353
-
SHA256
2cb254bd89b6683fe71587ecaeb53c517cb0cf9e630ee0366a338e5dc587c841
-
SHA512
d8651f1714b0e498b15cd5fcead4845e0eb45a0adc3563190d74861a91e0bdd7e22eb045abbc7bf599d5b5f95150e8109190dce8ce3e09fcbe60e449067440f1
-
SSDEEP
6144:AyH7xOc6H5c6HcT66vlmWTBHvnrSxHqHGTP+9IevMP41vAOhkqvcXq2ka3CUbpf1:AazBHvrSxHqHSehv2ka3Copfu0CXNmLz
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1660 svchost.exe 2916 9713e4828cb213187616e0fb93bdb330N.exe 2708 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 1660 svchost.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe 9713e4828cb213187616e0fb93bdb330N.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9713e4828cb213187616e0fb93bdb330N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3036 wrote to memory of 1660 3036 9713e4828cb213187616e0fb93bdb330N.exe 29 PID 3036 wrote to memory of 1660 3036 9713e4828cb213187616e0fb93bdb330N.exe 29 PID 3036 wrote to memory of 1660 3036 9713e4828cb213187616e0fb93bdb330N.exe 29 PID 3036 wrote to memory of 1660 3036 9713e4828cb213187616e0fb93bdb330N.exe 29 PID 1660 wrote to memory of 2916 1660 svchost.exe 30 PID 1660 wrote to memory of 2916 1660 svchost.exe 30 PID 1660 wrote to memory of 2916 1660 svchost.exe 30 PID 1660 wrote to memory of 2916 1660 svchost.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\9713e4828cb213187616e0fb93bdb330N.exe"C:\Users\Admin\AppData\Local\Temp\9713e4828cb213187616e0fb93bdb330N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\9713e4828cb213187616e0fb93bdb330N.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\9713e4828cb213187616e0fb93bdb330N.exe"C:\Users\Admin\AppData\Local\Temp\9713e4828cb213187616e0fb93bdb330N.exe"3⤵
- Executes dropped EXE
PID:2916
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
Filesize
315KB
MD577c5490cd07ee15b93c51edefdc1a4b3
SHA178079600de813e76af2d09762abaae03169bdd92
SHA25664a88ebd8bbddf00eaf035e1ceb7f76d5f5315e8af263f1fef61e30ffd6e5ab5
SHA5123513aed4b2b3b5957c7c7711a76aa5e50edaa744d9326ce037ce5ba3e9308abd21b09e1167c102ac888bd1c759a5a8800c014d50cc2b429b98e0096c2840b8e3