Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
003be3a7fc9edc7bc77fcd28b0f7b330N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
003be3a7fc9edc7bc77fcd28b0f7b330N.exe
Resource
win10v2004-20240802-en
General
-
Target
003be3a7fc9edc7bc77fcd28b0f7b330N.exe
-
Size
72KB
-
MD5
003be3a7fc9edc7bc77fcd28b0f7b330
-
SHA1
391a760ee9751a4a4a2544346580353c0f556f5f
-
SHA256
859911e17be1c3451ed24f741df0ad6b53d95f22388ec37d5b39f52338bec774
-
SHA512
e2771b1f3ae4ef8dc78d29f8a8d395b5b22dff60e57d06c3c4f924b5307fa9a77ce8e759894e190c0d46d13c477485b14b0584b9bff64a11e9caafded9f880f4
-
SSDEEP
1536:2XPyqDsprttrtt3naryrcDypTgccsW1QOotCJZgdLeAyNFI5Q:2X7DItrfaocyTgfsqQOlJZceAT5Q
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2100 Au_.exe -
Loads dropped DLL 4 IoCs
pid Process 2176 003be3a7fc9edc7bc77fcd28b0f7b330N.exe 2100 Au_.exe 2100 Au_.exe 2100 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 003be3a7fc9edc7bc77fcd28b0f7b330N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x0008000000018d89-2.dat nsis_installer_2 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2100 Au_.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2100 2176 003be3a7fc9edc7bc77fcd28b0f7b330N.exe 30 PID 2176 wrote to memory of 2100 2176 003be3a7fc9edc7bc77fcd28b0f7b330N.exe 30 PID 2176 wrote to memory of 2100 2176 003be3a7fc9edc7bc77fcd28b0f7b330N.exe 30 PID 2176 wrote to memory of 2100 2176 003be3a7fc9edc7bc77fcd28b0f7b330N.exe 30 PID 2176 wrote to memory of 2100 2176 003be3a7fc9edc7bc77fcd28b0f7b330N.exe 30 PID 2176 wrote to memory of 2100 2176 003be3a7fc9edc7bc77fcd28b0f7b330N.exe 30 PID 2176 wrote to memory of 2100 2176 003be3a7fc9edc7bc77fcd28b0f7b330N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\003be3a7fc9edc7bc77fcd28b0f7b330N.exe"C:\Users\Admin\AppData\Local\Temp\003be3a7fc9edc7bc77fcd28b0f7b330N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5003be3a7fc9edc7bc77fcd28b0f7b330
SHA1391a760ee9751a4a4a2544346580353c0f556f5f
SHA256859911e17be1c3451ed24f741df0ad6b53d95f22388ec37d5b39f52338bec774
SHA512e2771b1f3ae4ef8dc78d29f8a8d395b5b22dff60e57d06c3c4f924b5307fa9a77ce8e759894e190c0d46d13c477485b14b0584b9bff64a11e9caafded9f880f4