Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

fb885d8fac...8N.exe

windows7-x64

10

fb885d8fac...8N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 01:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fb885d8facb11669cec4eab2f2293a420deab266a3981b5af75f7a594559df68N.exe

  • Size

    135KB

  • MD5

    7cfac3074c665252bdcf11d5f2d0fd20

  • SHA1

    62c99a5ad322e77cf31d80a92809647bbcbd6203

  • SHA256

    fb885d8facb11669cec4eab2f2293a420deab266a3981b5af75f7a594559df68

  • SHA512

    7abf066a55c4c7ce99ce1369fa905eff9dd9d2063e396a2984d85f5e47b68e6174b46b6d4e2fb8dd9ce7e7469c742f10e7307fd4dfc45a182a0ddea591a081cf

  • SSDEEP

    1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVVKa:UVqoCl/YgjxEufVU0TbTyDDalLKa

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb885d8facb11669cec4eab2f2293a420deab266a3981b5af75f7a594559df68N.exe
    "C:\Users\Admin\AppData\Local\Temp\fb885d8facb11669cec4eab2f2293a420deab266a3981b5af75f7a594559df68N.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3536
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4324
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1760
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:960
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1016

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Resources\Themes\explorer.exe
    Filesize

    135KB

    MD5

    d24eb394a60428d6d866819727d68517

    SHA1

    28d3fae8f807f53416a868941131ac7eb5b5ffdd

    SHA256

    c182d4e30238962921adcb320d43c440e902fcaab55eb318516a778125b7740d

    SHA512

    73f571c89831f2c2f82eda71810f0eaac0eed8d73fb50bee8769efe82f95d8b730df6727501ad653cb138dd5df2493da9fd0bf647264f536068600df9f9d31df

    Download Submit

  • C:\Windows\Resources\spoolsv.exe
    Filesize

    135KB

    MD5

    7a03088437c2018228421d5f22872f14

    SHA1

    1bf7aaf3324f3f7a72cf8a817533858686b599af

    SHA256

    fabea995c1e5d451ce6705d8661298d694e7c24ae70f71351e52181260661497

    SHA512

    a7e85fdbc0958e85d48b6ac977dd2940306287a54d2512f6120a837a2fbbfa1952a734184113f2d37e6ea04c9898314b87875b2b13e56fb3c60eb0e4a9ff238b

    Download Submit

  • C:\Windows\Resources\svchost.exe
    Filesize

    135KB

    MD5

    a66d08be085682650c872ce5615cf8df

    SHA1

    8081d4c4b9e2306f844aa53d3503de8565dcac77

    SHA256

    72ce0fd7a6a832581d147ff39e935b4575c230417c43278c23869bb77f57da3e

    SHA512

    828f41648c37a7b98d9349724ca22daee2e4a7ea6ab790d8552a1a580e00f4f13d561ce52ed28be4339655205efcc60927360362ea65ebb72648e5a0984d9007

    Download Submit

  • memory/960-36-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1016-32-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1760-33-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3536-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3536-34-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/4324-35-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

    Download