Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 05:09

General

  • Target

    95a5f142e06894b1aa80e77f6758d820N.exe

  • Size

    52KB

  • MD5

    95a5f142e06894b1aa80e77f6758d820

  • SHA1

    eac64e4dba0615185ad29ad955c10463cd890948

  • SHA256

    ec78aa16f02bca6012711466c456a4d008ffebacd64b6be020e13bfae6ae1b7f

  • SHA512

    24d2330bfded7e66dd2238942be59cefce852411bf527517f9b34f6c0fab92fdf40d1c57f54d57c3e5d75d400efb8d1b4380cf4e4be0126114e3977af01cd134

  • SSDEEP

    768:/uWn2wgVPe4A7okNPL1jskr/v/m89S3rkC6R+wibw52TzpGh:/SVe4A7xRLNskr3mbkC6R+XpGh

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95a5f142e06894b1aa80e77f6758d820N.exe
    "C:\Users\Admin\AppData\Local\Temp\95a5f142e06894b1aa80e77f6758d820N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\pmnol.exe
      "C:\Users\Admin\pmnol.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2256

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\pmnol.exe

    Filesize

    52KB

    MD5

    ecba05662e74589c8a2231b8c855d510

    SHA1

    e4af13e9dcad38d1054fcb69ee0ad102fd045140

    SHA256

    435600cad92a2c4ae05ffe7633dd9812a684e4cbda2a068d315c31e7d50d04b2

    SHA512

    375cc515de23b0246f51410dda91bfe39eecfdaf7af236262853c76ca3c9b96b5ea2964eb3627ce52eb8e82563a8fe910c0e3bce3032429d28f2ecf43f156b92