Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
24/08/2024, 04:21
General
-
Target
2ab53c7723292f6e8c86ca6647961d40N.exe
-
Size
204KB
-
MD5
2ab53c7723292f6e8c86ca6647961d40
-
SHA1
c84a196ea4296dbee6857af9e68d6fda8accbe25
-
SHA256
33024a260ea95ec87fc4911f251d181efcaf4adf88579ee27f8f4a9e4ef0023c
-
SHA512
0eed8c4b00581ed547510bcdd4c5d2a5e6701f4242546799533428bf57b38b77226a0b73208605f5a9c64418a02f419afc3bda06587a04b56d6bb2a936f553db
-
SSDEEP
3072:C5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:CLexkuRaX41xoyJV65gzyZko+uc
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ab53c7723292f6e8c86ca6647961d40N.exe"C:\Users\Admin\AppData\Local\Temp\2ab53c7723292f6e8c86ca6647961d40N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD565f874128a0fe9fdb45d10831e1c25fc
SHA1b511da5749131cb143644a65694ed25047b2e17e
SHA2562940d5862f1d8ebc7d3d165096830c87502b255a3e6218de545f70d07a00f64a
SHA51203ae4903067bf7b9ffa4c39a612b03ab00bb7778270461504e350cb2e0d174110854b79c3c9361b81863af12afb900621805a58450675b99ce5dd7c079df9a88
-
Filesize
204KB
MD576ca04083a23639db68be4cb9c671376
SHA1d77965691f60ba4a7bd50483f1eac6edc2d4efdb
SHA2564ce301cdd28e9ca7bac3cef075d9e796f9aa69ceb2faf20054059602bcf6ed7d
SHA5122c3b25ad5cdd7be5f60f7b04fdbb58babe8991c9c36d18df6978fbeca9b4ebec4619b4a466d4163049cc2b32648a487fd306c70980ff0c64f0dfff863acc7e94
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB