Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 01:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe
-
Size
144KB
-
MD5
98f896438801d11898dcf02fbf1c045d
-
SHA1
9b2fa272eb0271c038e1607677d83812b7a3a97d
-
SHA256
c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa
-
SHA512
d2e5edb0c759a324624526b251d0a0c89c8739b69314ab354bba44a4b1bf1acef14fd2ba0fc1c8fa8c33704c41f7b0a38fab90a8561c4c762b5dcdfde13a8d58
-
SSDEEP
3072:l5SVkkgUgXC7AdYzrV+Dljy/32ubwZ/qJ:SUFCkdYzrVolu/J0Z/
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3496 WindowsService.exe 1964 WindowsService.exe 2244 WindowsService.exe -
Loads dropped DLL 5 IoCs
pid Process 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindows\\WindowsService.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2368 set thread context of 3248 2368 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 31 PID 3496 set thread context of 1964 3496 WindowsService.exe 36 PID 3496 set thread context of 2244 3496 WindowsService.exe 37 -
resource yara_rule behavioral1/memory/3248-445-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3248-485-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3248-1031-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1964-1034-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1964-1037-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe Token: SeDebugPrivilege 1964 WindowsService.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2368 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 3496 WindowsService.exe 1964 WindowsService.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2368 wrote to memory of 3248 2368 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 31 PID 2368 wrote to memory of 3248 2368 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 31 PID 2368 wrote to memory of 3248 2368 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 31 PID 2368 wrote to memory of 3248 2368 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 31 PID 2368 wrote to memory of 3248 2368 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 31 PID 2368 wrote to memory of 3248 2368 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 31 PID 2368 wrote to memory of 3248 2368 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 31 PID 2368 wrote to memory of 3248 2368 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 31 PID 3248 wrote to memory of 3420 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 32 PID 3248 wrote to memory of 3420 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 32 PID 3248 wrote to memory of 3420 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 32 PID 3248 wrote to memory of 3420 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 32 PID 3420 wrote to memory of 3472 3420 cmd.exe 34 PID 3420 wrote to memory of 3472 3420 cmd.exe 34 PID 3420 wrote to memory of 3472 3420 cmd.exe 34 PID 3420 wrote to memory of 3472 3420 cmd.exe 34 PID 3248 wrote to memory of 3496 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 35 PID 3248 wrote to memory of 3496 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 35 PID 3248 wrote to memory of 3496 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 35 PID 3248 wrote to memory of 3496 3248 c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe 35 PID 3496 wrote to memory of 1964 3496 WindowsService.exe 36 PID 3496 wrote to memory of 1964 3496 WindowsService.exe 36 PID 3496 wrote to memory of 1964 3496 WindowsService.exe 36 PID 3496 wrote to memory of 1964 3496 WindowsService.exe 36 PID 3496 wrote to memory of 1964 3496 WindowsService.exe 36 PID 3496 wrote to memory of 1964 3496 WindowsService.exe 36 PID 3496 wrote to memory of 1964 3496 WindowsService.exe 36 PID 3496 wrote to memory of 1964 3496 WindowsService.exe 36 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37 PID 3496 wrote to memory of 2244 3496 WindowsService.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe"C:\Users\Admin\AppData\Local\Temp\c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe"C:\Users\Admin\AppData\Local\Temp\c053874637f40ffdd8c2a669120d51c82d9abbddb6d654c261125174dbacf3fa.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\KOLLX.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "sidebar" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3472
-
-
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1964
-
-
C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindows\WindowsService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2244
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157B
MD5f6a90c20834f271a907a4e2bc28184c2
SHA136c9d1602b74f622346fbb22693597d7889df48d
SHA25673f29cd953eee40cea4de67842556ffd96efe8094a6a9b70f33a35df2582febd
SHA51239cabae19fe1faa37455e4bd242c868be60d6252b07f01224b3f7501c3cf734e503300b840d83381a452707cab6df2f95f920655884be56d4024676b26943804
-
Filesize
144KB
MD5eece50d97cb982682087c78c558c569d
SHA19f42774a7e3e68b67248f8773bff5f0bdeccbf1a
SHA2564871ae1b9a081cb7550596309eb09ad21db0820c24da13d1375714c54be74223
SHA512b52462951f785197e21374d988accb1da65407e1be9fbbe854cb51868e13497a2269216e4e1e1dbf7c3518b172e0ed3905caca71f5aa5cd819c1d01821ca35bc