Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 14:14
Static task
static1
Behavioral task
behavioral1
Sample
38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe
Resource
win7-20240708-en
General
-
Target
38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe
-
Size
330KB
-
MD5
ee1b0e6423386f2c53869725a16c24ae
-
SHA1
c3a06587bb81b375b1f1b606e279afb41150a26d
-
SHA256
38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc
-
SHA512
61bf4006cca47161050b335b42db5e0943b892848920a24e4c3334f76d93ad18951647f1d92c942c7c64b170027da5775b7ea3e2cdb04412a31a02f1fcc9136d
-
SSDEEP
6144:fxYrRwGrWwNDCBC2iDFOIh10+7vdX6Ba/AOIPb+PqR/J7y12:fxWrNtDFf1BrRHhiR/J7B
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2676 SIAMIT~1.EXE -
Loads dropped DLL 6 IoCs
pid Process 2644 38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe 2224 WerFault.exe 2224 WerFault.exe 2224 WerFault.exe 2224 WerFault.exe 2224 WerFault.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log 38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe -
pid Process 2988 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2224 2676 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIAMIT~1.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2988 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2988 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2644 38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2676 2644 38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe 30 PID 2644 wrote to memory of 2676 2644 38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe 30 PID 2644 wrote to memory of 2676 2644 38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe 30 PID 2644 wrote to memory of 2676 2644 38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe 30 PID 2676 wrote to memory of 2988 2676 SIAMIT~1.EXE 31 PID 2676 wrote to memory of 2988 2676 SIAMIT~1.EXE 31 PID 2676 wrote to memory of 2988 2676 SIAMIT~1.EXE 31 PID 2676 wrote to memory of 2988 2676 SIAMIT~1.EXE 31 PID 2676 wrote to memory of 2224 2676 SIAMIT~1.EXE 33 PID 2676 wrote to memory of 2224 2676 SIAMIT~1.EXE 33 PID 2676 wrote to memory of 2224 2676 SIAMIT~1.EXE 33 PID 2676 wrote to memory of 2224 2676 SIAMIT~1.EXE 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe"C:\Users\Admin\AppData\Local\Temp\38013984ecec19ab2889f68c3404c10c434b44ad68d9e3978cb853c18742dabc.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\SIAMIT~1.EXE"C:\Users\Admin\AppData\Local\Temp\SIAMIT~1.EXE" -hwnd 393504 -uninstall2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Get-WinUserLanguageList | ConvertTo-Json -Compress"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 5603⤵
- Loads dropped DLL
- Program crash
PID:2224
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD55d77bda9abaf2d713df2fb3b7db4860f
SHA164a3f12df35235d18d4af16f709bf2c03cb88032
SHA256865e73bc9f80c58fd2795709b549dc8fe8e09f86af6fc11a039cb134d4657419
SHA5120930ccf6ff6fa3cf0ebae60e69e226270f2ada40df5a8b42f5ad797d79a23618e6d632ca90ded9eacfc3905f6bee2d6db42f20b04017cfbe674fa112e49bd8b3
-
Filesize
26KB
MD50ee5c85d988e567c0fb740eb231e5e81
SHA1713547ca83b1c416603b8cc4786290af9e983712
SHA256e5ed3d2e0ba8e5e0a17b8e8e45b42e1a5d293e977c79c1856a6314bddcfc4389
SHA5128cdef4628ef05803eb38ce30546ee0099611f7fa1458148924cccd7e024a1c6fd8930909b42f8fa500b4dc3d2b3a8b7ad60a51ab72b6a439c1e080ae9864e9ca