Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe
Resource
win7-20240705-en
General
-
Target
29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe
-
Size
404KB
-
MD5
c03814b0ef1ae37561097cf94248c49e
-
SHA1
7003dadb3576967c9b8a4a5c97976f004443b975
-
SHA256
29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7
-
SHA512
327cbafd0df5a52af396ba5fe49349d99e49ef61b5b4ab7f03fe616dae9db644bc2d9c21c28e1a5b758ed9d6441798be39ac5bfa37284e0a254d50847575edcd
-
SSDEEP
6144:Tn77n8zu2DqpZUBDc2edbpIqAUwWIZwI64Q3dCw2BtBZ:H7nqArILUvIOMw
Malware Config
Signatures
-
NetWire RAT payload 2 IoCs
resource yara_rule behavioral1/memory/1988-18-0x0000000000080000-0x00000000000A0000-memory.dmp netwire behavioral1/memory/1988-23-0x0000000000080000-0x00000000000A0000-memory.dmp netwire -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dwms.exe.lnk 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe -
Executes dropped EXE 1 IoCs
pid Process 1988 svhost.exe -
Loads dropped DLL 1 IoCs
pid Process 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 280 set thread context of 1988 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 280 wrote to memory of 2772 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 30 PID 280 wrote to memory of 2772 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 30 PID 280 wrote to memory of 2772 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 30 PID 280 wrote to memory of 2772 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 30 PID 2772 wrote to memory of 2704 2772 cmd.exe 32 PID 2772 wrote to memory of 2704 2772 cmd.exe 32 PID 2772 wrote to memory of 2704 2772 cmd.exe 32 PID 2772 wrote to memory of 2704 2772 cmd.exe 32 PID 280 wrote to memory of 1988 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 33 PID 280 wrote to memory of 1988 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 33 PID 280 wrote to memory of 1988 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 33 PID 280 wrote to memory of 1988 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 33 PID 280 wrote to memory of 1988 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 33 PID 280 wrote to memory of 1988 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 33 PID 280 wrote to memory of 1988 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 33 PID 280 wrote to memory of 1988 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 33 PID 280 wrote to memory of 1988 280 29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe"C:\Users\Admin\AppData\Local\Temp\29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:280 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\TimeZone settings\dwms.exe.lnk" /f3⤵
- System Location Discovery: System Language Discovery
PID:2704
-
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD532827e69b293b99013bbbe37d029245d
SHA1bc9f80a38f09354d71467a05b0c5a82c3f7dac53
SHA2569250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f
SHA51258c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5
-
Filesize
404KB
MD5c03814b0ef1ae37561097cf94248c49e
SHA17003dadb3576967c9b8a4a5c97976f004443b975
SHA25629926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7
SHA512327cbafd0df5a52af396ba5fe49349d99e49ef61b5b4ab7f03fe616dae9db644bc2d9c21c28e1a5b758ed9d6441798be39ac5bfa37284e0a254d50847575edcd