Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 09:24
Static task
static1
Behavioral task
behavioral1
Sample
5f1b878a21b60e4ac81f3a54c9539bb0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5f1b878a21b60e4ac81f3a54c9539bb0N.exe
Resource
win10v2004-20240802-en
General
-
Target
5f1b878a21b60e4ac81f3a54c9539bb0N.exe
-
Size
1.0MB
-
MD5
5f1b878a21b60e4ac81f3a54c9539bb0
-
SHA1
dbfab1552106e112475009c708d4c06efa7bab06
-
SHA256
fb5378e01f46ff1a9b3a0322451552918bef0c3a7f2a1fc82f1a3d783753dbcd
-
SHA512
fe8443f8aa389dc30947b8cff1fc3df161a58325ecfdc708226e63724c38eb6d8b5f608f31626bd59f9e73c27921d3b7255fe9135bea83653a470b379d760eef
-
SSDEEP
24576:4CuQ7k91hxia8yBIwcG4RtegeohjT6S71OUnSAx:puQ7k91hxia8E93eZD17rx
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 5f1b878a21b60e4ac81f3a54c9539bb0N.exe -
Deletes itself 1 IoCs
pid Process 2724 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2872 5f1b878a21b60e4ac81f3a54c9539bb0N.exe -
Loads dropped DLL 2 IoCs
pid Process 2724 cmd.exe 2724 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 5f1b878a21b60e4ac81f3a54c9539bb0N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 5f1b878a21b60e4ac81f3a54c9539bb0N.exe File created C:\Windows\Logo1_.exe 5f1b878a21b60e4ac81f3a54c9539bb0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5f1b878a21b60e4ac81f3a54c9539bb0N.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1960 wrote to memory of 756 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 31 PID 1960 wrote to memory of 756 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 31 PID 1960 wrote to memory of 756 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 31 PID 1960 wrote to memory of 756 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 31 PID 756 wrote to memory of 2196 756 net.exe 33 PID 756 wrote to memory of 2196 756 net.exe 33 PID 756 wrote to memory of 2196 756 net.exe 33 PID 756 wrote to memory of 2196 756 net.exe 33 PID 1960 wrote to memory of 2724 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 34 PID 1960 wrote to memory of 2724 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 34 PID 1960 wrote to memory of 2724 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 34 PID 1960 wrote to memory of 2724 1960 5f1b878a21b60e4ac81f3a54c9539bb0N.exe 34 PID 2724 wrote to memory of 2872 2724 cmd.exe 36 PID 2724 wrote to memory of 2872 2724 cmd.exe 36 PID 2724 wrote to memory of 2872 2724 cmd.exe 36 PID 2724 wrote to memory of 2872 2724 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f1b878a21b60e4ac81f3a54c9539bb0N.exe"C:\Users\Admin\AppData\Local\Temp\5f1b878a21b60e4ac81f3a54c9539bb0N.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:2196
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$aEDF7.bat2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\5f1b878a21b60e4ac81f3a54c9539bb0N.exe"C:\Users\Admin\AppData\Local\Temp\5f1b878a21b60e4ac81f3a54c9539bb0N.exe"3⤵
- Executes dropped EXE
PID:2872
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
536B
MD57622674baf856651054a1e36e3aca883
SHA1ba7564c955225ac07da74e15a3d48a1926cbc4dd
SHA256631c9d9da3afe80fd3eee3620a3f48b265e1577b97296f2bd830da11e9599041
SHA512dccd93adf54ecb6845e1db7cb1553b413ab79057e5190b7b6aa2b6cb29414a161c9872c4aa0ab35e3f171635cb70f62b1df4ff5fbcdb73f668989531c08d3edb
-
Filesize
1004KB
MD5148064f3f1e91ecd6561984925d47f00
SHA10d0fd99b96fb0261227394846f18995820e720b4
SHA25601b6ee8d51719143cea2b6bede99299dac088b224fd363eea28178918fa85a6b
SHA512d5b0acb091453c95b67fd01e21cfc1a2bfe2900ee729b60139f41e2126a79a33781e4db824ef2082e014edfae81feadebb831341879fed110f216317c1716c1f