Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 00:08
Static task
static1
Behavioral task
behavioral1
Sample
c7b2759c599ed4c14b5e3f3bc02b93d0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c7b2759c599ed4c14b5e3f3bc02b93d0N.exe
Resource
win10v2004-20240802-en
General
-
Target
c7b2759c599ed4c14b5e3f3bc02b93d0N.exe
-
Size
116KB
-
MD5
c7b2759c599ed4c14b5e3f3bc02b93d0
-
SHA1
bdf53006a54b8f44f50143fe2129ccabfaca4292
-
SHA256
d46896a61b939a1dc97f6ec994463f6792ac35dc96c127a11fc8c1550a9b0bbd
-
SHA512
ce0b9fe4bd0985240b0a004d2ca561ce6522d279a29f03bb96d834a8df5b840004f5f1844264d557dcdc8d0b740b85699157c998cbd6a9168c20470f6c150d60
-
SSDEEP
768:t6eHIMgPRVUUC151Npquv3RnFKE7pGnbcuyD7UTTE:tFo5U5bLpXRkPnouy8k
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2780 trys.exe -
Loads dropped DLL 5 IoCs
pid Process 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ineter Mc = "C:\\Users\\Admin\\AppData\\Roaming\\trys.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7b2759c599ed4c14b5e3f3bc02b93d0N.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe Token: SeDebugPrivilege 2780 trys.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 2780 trys.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2712 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 30 PID 2844 wrote to memory of 2712 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 30 PID 2844 wrote to memory of 2712 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 30 PID 2844 wrote to memory of 2712 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 30 PID 2712 wrote to memory of 2616 2712 cmd.exe 32 PID 2712 wrote to memory of 2616 2712 cmd.exe 32 PID 2712 wrote to memory of 2616 2712 cmd.exe 32 PID 2712 wrote to memory of 2616 2712 cmd.exe 32 PID 2844 wrote to memory of 2780 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 33 PID 2844 wrote to memory of 2780 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 33 PID 2844 wrote to memory of 2780 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 33 PID 2844 wrote to memory of 2780 2844 c7b2759c599ed4c14b5e3f3bc02b93d0N.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7b2759c599ed4c14b5e3f3bc02b93d0N.exe"C:\Users\Admin\AppData\Local\Temp\c7b2759c599ed4c14b5e3f3bc02b93d0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\GUQOT.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2616
-
-
-
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD56dbb2090ff90500da05a027765cde190
SHA1425b833d9d1df8d6df6e5a59f738058808271949
SHA25671ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881
SHA5127e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3
-
Filesize
116KB
MD5f536900fd17752132f5e0b3a8afb4b66
SHA1b40a2baf7ecc32e153fa4fd1e6e807964ee4f855
SHA2564712cdb0b39b0daeb8093e45e900dcad8ea025fcfc4d075a9260dc087831babb
SHA51233819e29ddae4ba74a9357193f8d1af703fa25698a75d8987cb86b5ad44647e750a4ea88a22b6b58b9388160ad02d9a01756db2d4d1d09d262d666f8deb5d259