Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 09:10
Static task
static1
Behavioral task
behavioral1
Sample
24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe
Resource
win10v2004-20240802-en
General
-
Target
24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe
-
Size
908KB
-
MD5
58af7b91af918aaaf0517c50728ea7ed
-
SHA1
a36361938df502286245392342b9f5d0c214ac94
-
SHA256
24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49
-
SHA512
abfceb84ae216b4f92a7290d4d3ad0e7bb845026ea760d3d948479a792b1fbe8a526298ed5df8f4a4b7401aa8afc773f2920ea04be43e04b239f8586259840c6
-
SSDEEP
12288:QqjqRBa80gi+TCUQpd6KA26mY6nltHnhm9FXRN:QwqN0gi+TCUQvHEFXb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2528 print.exe -
Loads dropped DLL 1 IoCs
pid Process 2252 24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\model = "C:\\Users\\Admin\\AppData\\Roaming\\model\\print.exe" 24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2528 set thread context of 1852 2528 print.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language print.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1852 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1852 RegAsm.exe Token: 33 1852 RegAsm.exe Token: SeIncBasePriorityPrivilege 1852 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1852 RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2528 2252 24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe 31 PID 2252 wrote to memory of 2528 2252 24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe 31 PID 2252 wrote to memory of 2528 2252 24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe 31 PID 2252 wrote to memory of 2528 2252 24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe 31 PID 2528 wrote to memory of 1852 2528 print.exe 32 PID 2528 wrote to memory of 1852 2528 print.exe 32 PID 2528 wrote to memory of 1852 2528 print.exe 32 PID 2528 wrote to memory of 1852 2528 print.exe 32 PID 2528 wrote to memory of 1852 2528 print.exe 32 PID 2528 wrote to memory of 1852 2528 print.exe 32 PID 2528 wrote to memory of 1852 2528 print.exe 32 PID 2528 wrote to memory of 1852 2528 print.exe 32 PID 2528 wrote to memory of 1852 2528 print.exe 32 PID 2528 wrote to memory of 1852 2528 print.exe 32 PID 2528 wrote to memory of 1852 2528 print.exe 32 PID 2528 wrote to memory of 1852 2528 print.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe"C:\Users\Admin\AppData\Local\Temp\24d6bdcc1fd603ed16d96146e9dd9c3c876c19f70a0b262de431e5c333b43d49.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Roaming\model\print.exe"C:\Users\Admin\AppData\Roaming\model\print.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1852
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
908KB
MD5708573e1307a8a8eff341f1a4e183777
SHA1d835069fb5f14e989803dd251a5eace94a264888
SHA2565a64ea4078046e2518137bf0c82acecec8a40944e0300de46aa3bfe1ddc21df1
SHA5128e06b66e8d48a3fc86db04abb2c0c65756258a5a1366ae35d327bf14ea0477737fed42659135fb49eb4ddae172309e2f48f8c9b092d30ee5b816dccdbdb390af