Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5b4764332b...0N.exe

windows7-x64

10

5b4764332b...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 23:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b4764332be4aef7cb426e6852702670N.exe

  • Size

    207KB

  • MD5

    5b4764332be4aef7cb426e6852702670

  • SHA1

    c22b91bce47529767b2d4dfb7e1d14bc62438469

  • SHA256

    336b7daa3ecfcb6db2f1cc975d7543ce5beffc731027a1645ffd9abd4d029742

  • SHA512

    417de9c11475bdf584987e76ba4b3f2506922fba3a972bc4bc0ecab72402ebd0b3bcf724c59c11c57f7eb58c5bce0764d7ea67339424cd08732ca2f9cd4f2b09

  • SSDEEP

    1536:/fsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbJdo:/VqoCl/YgjxEufVU0TbTyDDalbo

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b4764332be4aef7cb426e6852702670N.exe
    "C:\Users\Admin\AppData\Local\Temp\5b4764332be4aef7cb426e6852702670N.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3252
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1440
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1544
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3492
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:3768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\spoolsv.exe
    Filesize

    207KB

    MD5

    cd54601b9fca707738af63cc9e5a00f5

    SHA1

    82c222e80c63792dc54fa8445ac876c426dbc9e2

    SHA256

    faf52c098e996e4c8f1e5af42f73309ca6df6d9c51794c2c71cd0fab986624e5

    SHA512

    2bd6ecca93a73895c8db68d0e25571ef03ce94da68a6d6f2cf5ced141ded058d688a26fa6274b01e91d7dba577ed3ed874bda44ab923284128586ea26a149bd2

    Download Submit

  • C:\Windows\Resources\svchost.exe
    Filesize

    206KB

    MD5

    a1ebbaedd763b1281d0aca27d4e53eff

    SHA1

    ea407b58f3eb6159e0b195c837bf61a818bd0543

    SHA256

    7cbb976565fe04ab6e2bb1264f6171093636de8377d2af38ce53192b47f0234f

    SHA512

    b21dae50eb0e745262837eb1ced3444702bb55aaa2f401501ef2859affafcd5f8c07eb83c4c43e286d05cc7b057581a002c28af1fb724b55df9cb350e646d62b

    Download Submit

  • \??\c:\windows\resources\themes\explorer.exe
    Filesize

    206KB

    MD5

    9d9848284f7bc09ba6c8663705a14bd5

    SHA1

    4b4e47a9f74ceb384fd7617c448f999f4e9a089c

    SHA256

    9bca00a2d79664902d6adef0c24c0dd033003cf524d5e729934927a3eaed1c7f

    SHA512

    0c50f5940f787bdfb79881573edad17a1d39ee59921bde0d26127afd3463fb98ecd740ed861d334a50d4a90c4bfb0983e9dfa65ce5a8776c673d43cea60deeda

    Download Submit

  • memory/1440-35-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1544-33-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3252-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3252-34-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3492-36-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3768-32-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download