Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 10:39
Behavioral task
behavioral1
Sample
1325616808efbd6d8b95f40b3eb5eca0N.exe
Resource
win7-20240903-en
General
-
Target
1325616808efbd6d8b95f40b3eb5eca0N.exe
-
Size
38KB
-
MD5
1325616808efbd6d8b95f40b3eb5eca0
-
SHA1
be8ea41e71eeba1110657558c71a247e887c6475
-
SHA256
059c666ad1ca23d638a4e67f38c0aecb743fe830283fffe6fbdd6e147b37bac8
-
SHA512
0917207cb2ae44603f73745a70eb1873df4dc5df308aa45ac75dac148286f56dd020d02e9c188cc3f1d5cf6c6654867926d4e0a7fa417821a697f2bf9515a462
-
SSDEEP
768:Nzj1JegVa3Gry+uELEmITCs/NUZ6nZdYbCLECkrQoP9fmF2f1cOGu:NWQa2TLEmITcoQxfllfmS1cOt
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2460 smss.exe -
Loads dropped DLL 2 IoCs
pid Process 2108 1325616808efbd6d8b95f40b3eb5eca0N.exe 2108 1325616808efbd6d8b95f40b3eb5eca0N.exe -
resource yara_rule behavioral1/memory/2108-0-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/files/0x0007000000018b03-4.dat upx behavioral1/memory/2460-12-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/2460-18-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral1/memory/2108-20-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\1230\smss.exe 1325616808efbd6d8b95f40b3eb5eca0N.exe File opened for modification C:\Windows\SysWOW64\1230\smss.exe smss.exe File opened for modification C:\Windows\SysWOW64\Service.exe smss.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2348 sc.exe 1892 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1325616808efbd6d8b95f40b3eb5eca0N.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2108 1325616808efbd6d8b95f40b3eb5eca0N.exe 2460 smss.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2348 2108 1325616808efbd6d8b95f40b3eb5eca0N.exe 30 PID 2108 wrote to memory of 2348 2108 1325616808efbd6d8b95f40b3eb5eca0N.exe 30 PID 2108 wrote to memory of 2348 2108 1325616808efbd6d8b95f40b3eb5eca0N.exe 30 PID 2108 wrote to memory of 2348 2108 1325616808efbd6d8b95f40b3eb5eca0N.exe 30 PID 2108 wrote to memory of 2460 2108 1325616808efbd6d8b95f40b3eb5eca0N.exe 32 PID 2108 wrote to memory of 2460 2108 1325616808efbd6d8b95f40b3eb5eca0N.exe 32 PID 2108 wrote to memory of 2460 2108 1325616808efbd6d8b95f40b3eb5eca0N.exe 32 PID 2108 wrote to memory of 2460 2108 1325616808efbd6d8b95f40b3eb5eca0N.exe 32 PID 2460 wrote to memory of 1892 2460 smss.exe 33 PID 2460 wrote to memory of 1892 2460 smss.exe 33 PID 2460 wrote to memory of 1892 2460 smss.exe 33 PID 2460 wrote to memory of 1892 2460 smss.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\1325616808efbd6d8b95f40b3eb5eca0N.exe"C:\Users\Admin\AppData\Local\Temp\1325616808efbd6d8b95f40b3eb5eca0N.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe stop wscsvc2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2348
-
-
C:\Windows\SysWOW64\1230\smss.exeC:\Windows\system32\1230\smss.exe -d2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe stop wscsvc3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1892
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5bc351d93632b4a419630248bf5d7b635
SHA1997db2212f121689ae3b3f15f6ab5015404cc25f
SHA25699312f14e8662c29f82f375e61c67f14e1077e62a71e266716e00bb3eb757731
SHA512d85dd5c21df4fd372c2161bb2cd2e09972ed5f090398ebd15275605d20dda957754dcd07afad8c8c5add7b4af7235f0aac2faf41cb316b2f553f853cb8b77f98