Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 14:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe
-
Size
18KB
-
MD5
38c69afeef3326f419418332de4f77a0
-
SHA1
224e853043042ab4b759f42e9452736bbdfc1d04
-
SHA256
27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636
-
SHA512
99ee072769ff68bf92c1aa93f09bd941c559f65ec355126ea21e01b96211f7ccb7e2611b68158ac7fa3e659dc712b4d560c25afbacebe1402e98c6ad525259df
-
SSDEEP
384:r6eHIAx0pqNgHvRtoyhAkeKE7pDKbR6hcdBYpBmLE:r6eHIMgPRtzykeKE7pkRpTE
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2744 trys.exe -
Loads dropped DLL 5 IoCs
pid Process 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ineter Mc = "C:\\Users\\Admin\\AppData\\Roaming\\trys.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe Token: SeDebugPrivilege 2744 trys.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 2744 trys.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2720 wrote to memory of 648 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 31 PID 2720 wrote to memory of 648 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 31 PID 2720 wrote to memory of 648 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 31 PID 2720 wrote to memory of 648 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 31 PID 648 wrote to memory of 2592 648 cmd.exe 33 PID 648 wrote to memory of 2592 648 cmd.exe 33 PID 648 wrote to memory of 2592 648 cmd.exe 33 PID 648 wrote to memory of 2592 648 cmd.exe 33 PID 2720 wrote to memory of 2744 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 34 PID 2720 wrote to memory of 2744 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 34 PID 2720 wrote to memory of 2744 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 34 PID 2720 wrote to memory of 2744 2720 27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe"C:\Users\Admin\AppData\Local\Temp\27a614dae223a2096b8d7bf175af924d8f6988ee6efe03c0f50375b559f7e636N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\OINKK.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2592
-
-
-
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD56dbb2090ff90500da05a027765cde190
SHA1425b833d9d1df8d6df6e5a59f738058808271949
SHA25671ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881
SHA5127e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3
-
Filesize
18KB
MD5136c6bd53755e797869e7b9a0edc429c
SHA11c7c04c4b57039156cb2f154c856fb9cd920cfc0
SHA2562da68efb09d12175c6175836ec8a7639b189b946977e4f8882a2e14080803468
SHA512f6c1eef7cf617c0010dc46f0a4274479e87d1ff0b35fdb0d6760d90cda5f77886053579ad5483e696529639e601d00921410eab47db2b612fd3acb12a1a5c37c