Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

7ddf9357a8...bc.exe

windows7-x64

10

7ddf9357a8...bc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/08/2024, 23:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7ddf9357a84e919c258ee3433dbc1c86e4dfc35b4816cc05c4fb18beb20fe0bc.exe

  • Size

    135KB

  • MD5

    58152863ee670eca3dbf9a2430759bc4

  • SHA1

    20d0c59274bf766666b701327a2c8aea8b4f26d6

  • SHA256

    7ddf9357a84e919c258ee3433dbc1c86e4dfc35b4816cc05c4fb18beb20fe0bc

  • SHA512

    1da8ee454dcdda81f11453ff29215f9a393a4744b43e1af24c0ae4fef4447a6cf8bf8d54f4f1404657c001b8aa7831e0d5b264e61bd76ac64e4ff43bf14a8fcc

  • SSDEEP

    1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVBu:UVqoCl/YgjxEufVU0TbTyDDal7u

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ddf9357a84e919c258ee3433dbc1c86e4dfc35b4816cc05c4fb18beb20fe0bc.exe
    "C:\Users\Admin\AppData\Local\Temp\7ddf9357a84e919c258ee3433dbc1c86e4dfc35b4816cc05c4fb18beb20fe0bc.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2388
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4116
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1756
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1420
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe
    Filesize

    135KB

    MD5

    4093b657e0e1c515ed554a8e26c909f9

    SHA1

    5f60ed13d26b4131c36188df54732a8f082945bb

    SHA256

    c9736107ab55acaf6bbe47e19244ac98aa1af7e49ccd17d182b72d6c5f42a78d

    SHA512

    321758788a3687e3dd4ba592b99a00925fe06ab7a0fd510f50b8637d00d7e195716f0e15f1943096d6b6df24d1e0e2f31ed91408e9d0a9257a57f754fe642a3b

    Download Submit

  • C:\Windows\Resources\spoolsv.exe
    Filesize

    135KB

    MD5

    d3de298d7255cdca6af9be912526ab1c

    SHA1

    71b270b83cfa487459b1bebd5d72b8e62b33f32f

    SHA256

    cad62d6df5a97e2081c8533b8ac1fe1c386271be09038a436c772a4c40c6cd2c

    SHA512

    9ffbea528f342b0f80d3790c474b512032874d0c8c132bac8e1c3e2527b3553629ddd614b03589946bbb580faac60a2e668ef98f5045a0396f0355474c4fc349

    Download Submit

  • C:\Windows\Resources\svchost.exe
    Filesize

    135KB

    MD5

    2e20663bba0c7d00fd1e8f59e52e3dac

    SHA1

    aff4b972bbead2e317c07fe929c91be527efe3d6

    SHA256

    2c0dcf51e8a074f37308b208318fec57795af26b0f9afaeb9af2db3b3c88e9e5

    SHA512

    b8d985bccf4e337c879977653724ab85ef84edfe0b15b0a74c5a983f493cc382e9965094a226e9c0369cce5a0ccb449c3cd17337585d94beee65228396eb6402

    Download Submit

  • memory/1420-37-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1756-34-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2388-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2388-35-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2408-29-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/2408-33-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4116-36-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download