Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    22s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 14:44

General

  • Target

    396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe

  • Size

    5.1MB

  • MD5

    aa1c1ce4915e430238dd1579fe0ee320

  • SHA1

    6df35550b84eb4b2648a09ff2be348ee326e7e78

  • SHA256

    396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53

  • SHA512

    04d46c3d8f73941b017b8c64302eebffe7a77a39d63c83dfbc5f71e45d1824557ea174dcc36c9ec82a4a176ae72ef840457855a11724314d255775b548f19d2e

  • SSDEEP

    98304:xXZvnKYEUwMXKCEXZvnKYEUwMXKC6XZvnKYEUwMXKC:xtnf3rXJEtnf3rXJ6tnf3rXJ

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe
    "C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2944
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SBYYcyqg.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3052
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SBYYcyqg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1989.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:580
    • C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe
      "C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe"
      2⤵
        PID:2764
      • C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe
        "C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe"
        2⤵
          PID:2904
        • C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe
          "C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe"
          2⤵
            PID:2648
          • C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe
            "C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe"
            2⤵
              PID:2672
            • C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe
              "C:\Users\Admin\AppData\Local\Temp\396b9c091d6328765df31c29d2e6e5e28f2472d63052ec39447d4325b8f3bf53.exe"
              2⤵
                PID:2716

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp1989.tmp

              Filesize

              1KB

              MD5

              0557bc38284ea7fe8725a70160b0c0f3

              SHA1

              c301beb3ec3445ce1f3d0354514ee3cab26caa71

              SHA256

              e0e07720f7bba9fd79f70e73b083717171821f4c050ec265610ff9dbd4a13088

              SHA512

              7c7263a7c8f18619f4aad7f7b75c82a0d05fca57904e726a43012f42e7ccb8221a28f24f94934ad603494b4ee0d93b38cc5975821116a845f9f296a62faf139f

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

              Filesize

              7KB

              MD5

              d118a0cd693a85fe1673f2fc2b22a1eb

              SHA1

              9beddb5313a8cfa9df00adb9cd4e554d84d6cae3

              SHA256

              ef254b141ac345bed32052fb56dc6178c81cf2551d5bc9411408909997714e2a

              SHA512

              c698227c5d56b19807b5565386c4266b337f7f06cd7efbf37709dc3e3820849dff6d55244da0a2c0f7bf5c8ede3e36b686945f106da6469821bb328944cefcae

            • memory/2296-0-0x000000007416E000-0x000000007416F000-memory.dmp

              Filesize

              4KB

            • memory/2296-1-0x0000000000320000-0x0000000000836000-memory.dmp

              Filesize

              5.1MB

            • memory/2296-2-0x0000000074160000-0x000000007484E000-memory.dmp

              Filesize

              6.9MB

            • memory/2296-3-0x0000000000C80000-0x0000000000C9E000-memory.dmp

              Filesize

              120KB

            • memory/2296-4-0x000000007416E000-0x000000007416F000-memory.dmp

              Filesize

              4KB

            • memory/2296-5-0x0000000074160000-0x000000007484E000-memory.dmp

              Filesize

              6.9MB

            • memory/2296-6-0x00000000008E0000-0x00000000008F6000-memory.dmp

              Filesize

              88KB

            • memory/2296-7-0x0000000006140000-0x00000000062BE000-memory.dmp

              Filesize

              1.5MB

            • memory/2296-20-0x0000000074160000-0x000000007484E000-memory.dmp

              Filesize

              6.9MB