Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
7efc274c76d04761bb3e4837bd7179f0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7efc274c76d04761bb3e4837bd7179f0N.exe
Resource
win10v2004-20240802-en
General
-
Target
7efc274c76d04761bb3e4837bd7179f0N.exe
-
Size
288KB
-
MD5
7efc274c76d04761bb3e4837bd7179f0
-
SHA1
7aa810c72fca5402bb29b8a28f62ea4220b2fb5c
-
SHA256
7ec5b466d139b05ca9980b0ba59a754ddfbae1948e263136fa2ba42d1e96abd0
-
SHA512
28b760204c2b231dabc6c66d1023843f2c2f6fc3e8ab6ed325e0aef316d08c3c8e88e14557f0840ec86b2a72c75c7ec49a75fd2e847a265f8e9b9569750030c0
-
SSDEEP
6144:gQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:gQMyfmNFHfnWfhLZVHmOog
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2728 csrssys.exe 2880 csrssys.exe -
Loads dropped DLL 4 IoCs
pid Process 1700 7efc274c76d04761bb3e4837bd7179f0N.exe 1700 7efc274c76d04761bb3e4837bd7179f0N.exe 1700 7efc274c76d04761bb3e4837bd7179f0N.exe 2728 csrssys.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7efc274c76d04761bb3e4837bd7179f0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csrssys.exe -
Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\ = "Application" 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\shell\open\command 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\Content-Type = "application/x-msdownload" 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\DefaultIcon 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\open 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\open\command 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\shell\runas\command\IsolatedCommand = "\"%1\" %*" 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\runas\command 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\Content-Type = "application/x-msdownload" 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\shell\open\command\IsolatedCommand = "\"%1\" %*" 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\ = "wexplorer" 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\shell\runas\command 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\shell\runas 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\runas 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\DefaultIcon\ = "%1" 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\shell 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\shell\open 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\csrssys.exe\" /START \"%1\" %*" 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\csrssys.exe\" /START \"%1\" %*" 7efc274c76d04761bb3e4837bd7179f0N.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\DefaultIcon 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\wexplorer\shell\runas\command\ = "\"%1\" %*" 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\DefaultIcon\ = "%1" 7efc274c76d04761bb3e4837bd7179f0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" 7efc274c76d04761bb3e4837bd7179f0N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2728 csrssys.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2728 1700 7efc274c76d04761bb3e4837bd7179f0N.exe 30 PID 1700 wrote to memory of 2728 1700 7efc274c76d04761bb3e4837bd7179f0N.exe 30 PID 1700 wrote to memory of 2728 1700 7efc274c76d04761bb3e4837bd7179f0N.exe 30 PID 1700 wrote to memory of 2728 1700 7efc274c76d04761bb3e4837bd7179f0N.exe 30 PID 2728 wrote to memory of 2880 2728 csrssys.exe 31 PID 2728 wrote to memory of 2880 2728 csrssys.exe 31 PID 2728 wrote to memory of 2880 2728 csrssys.exe 31 PID 2728 wrote to memory of 2880 2728 csrssys.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\7efc274c76d04761bb3e4837bd7179f0N.exe"C:\Users\Admin\AppData\Local\Temp\7efc274c76d04761bb3e4837bd7179f0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\csrssys.exe"3⤵
- Executes dropped EXE
PID:2880
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD5fefcd0641306ab75581c58b86d77578c
SHA1aecc97f6fc69190587be54ce653382b1d63373ad
SHA2568ffc4a3af9db1cb3b5a10779e7f5e8a8d34f95e8350b93b33b8638518c229d5c
SHA512f3ecf56382fb975c59303c2ddb789b8840b1b7b2577b4552de25edc67ed2251b6399c72603e858dac2c4ad54a65449662e7bb131a0f508499ed8027eb823597f