Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 10:49
Static task
static1
Behavioral task
behavioral1
Sample
596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe
Resource
win10v2004-20240802-en
General
-
Target
596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe
-
Size
457KB
-
MD5
fd298c7e47aa48480c46aa46b9960de0
-
SHA1
8d6d60879d2b7825cac6734e07417f2258412f21
-
SHA256
596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180
-
SHA512
e9048b79bbf8a8999c0cbfb469be17b44bdbf49c65a6699c8624fcfc2bba55fcb0053817a225bd51b4fe2d348b1bbc676445eedca08d6294c3afb191270dfb11
-
SSDEEP
12288:dfHdyKR7PfIcCKdjo47UQejmOFJ7hY2Sfe/:dfHQALIbKWEReXFJ7hY2
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2760 iD01814NmMaK01814.exe -
Executes dropped EXE 1 IoCs
pid Process 2760 iD01814NmMaK01814.exe -
Loads dropped DLL 2 IoCs
pid Process 2472 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe 2472 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\iD01814NmMaK01814 = "C:\\ProgramData\\iD01814NmMaK01814\\iD01814NmMaK01814.exe" iD01814NmMaK01814.exe -
resource yara_rule behavioral1/memory/2472-2-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/2472-19-0x0000000000400000-0x00000000004BF000-memory.dmp upx behavioral1/memory/2472-18-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/2760-23-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/2760-32-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral1/memory/2760-42-0x0000000000400000-0x00000000004C1000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iD01814NmMaK01814.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iD01814NmMaK01814.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2472 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2472 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe Token: SeDebugPrivilege 2760 iD01814NmMaK01814.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2760 iD01814NmMaK01814.exe 2760 iD01814NmMaK01814.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2760 2472 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe 30 PID 2472 wrote to memory of 2760 2472 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe 30 PID 2472 wrote to memory of 2760 2472 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe 30 PID 2472 wrote to memory of 2760 2472 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe"C:\Users\Admin\AppData\Local\Temp\596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\ProgramData\iD01814NmMaK01814\iD01814NmMaK01814.exe"C:\ProgramData\iD01814NmMaK01814\iD01814NmMaK01814.exe" "C:\Users\Admin\AppData\Local\Temp\596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD558030ef982501e36dde5392dfbcc62ab
SHA16cfc1d00ad2c6ce0453aab269f643f999e063f5a
SHA256ebabb6d089a9e180a2e1c3fb893dea4d71398853c38437813ff720672df28e7c
SHA512dcbfc153edbb2fc25c8074320987b96342a1e1f17a93c4c99fff697e45e604a6ac5ec068976fa021197a565455e723cc1a73b1394a6ba95451fc5eedb9451c0a
-
Filesize
457KB
MD542ba1216055942c6f3d89422c940b3e7
SHA14cd965d7ba4a33dc282f20d44e0932d1b623b03d
SHA25692b0f3171529fe2b8a897ac4e95b810c35ceffa0ca49cd2cfa6d4e246f428dfb
SHA512070700123e4639ed11bb12f9b0cbd8b7715ffc4612219de574b0820074f3442ef8b80dcdfa7251a1ef345359efa423b1d96b620bf804cd46c5c53e976586c478