Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe
Resource
win10v2004-20240802-en
General
-
Target
541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe
-
Size
5.9MB
-
MD5
d5cf63bd40ee7264411d869b1e0dedc0
-
SHA1
5ff886581eb6772a93a066b1c66916b58f2d0f8f
-
SHA256
541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04c
-
SHA512
97e5ec0dc6a598b675990b4c84e32438e4636fc204f1954d3fd188399c1a6404bf53c41d5061baa898be17ce76a26c3326251450c5be86726a939a87297bb86c
-
SSDEEP
98304:oKgKdd/yzt67OU7apwKgKdd/yzt67OU7apwKgKdd/yzt67OU7apv:0Cazg7DS8Cazg7DS8Cazg7DSv
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2828 7D57AD13E21.exe 2912 Scegli_nome_allegato.exe 1708 7D57AD13E21.exe -
Loads dropped DLL 3 IoCs
pid Process 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\7D57AD13E21.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2828 set thread context of 1708 2828 7D57AD13E21.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D57AD13E21.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Scegli_nome_allegato.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D57AD13E21.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main Scegli_nome_allegato.exe Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Scegli_nome_allegato.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Scegli_nome_allegato.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2908 reg.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2912 Scegli_nome_allegato.exe 2912 Scegli_nome_allegato.exe 2912 Scegli_nome_allegato.exe 1708 7D57AD13E21.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2908 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 30 PID 2932 wrote to memory of 2908 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 30 PID 2932 wrote to memory of 2908 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 30 PID 2932 wrote to memory of 2908 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 30 PID 2932 wrote to memory of 2828 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 32 PID 2932 wrote to memory of 2828 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 32 PID 2932 wrote to memory of 2828 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 32 PID 2932 wrote to memory of 2828 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 32 PID 2932 wrote to memory of 2912 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 33 PID 2932 wrote to memory of 2912 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 33 PID 2932 wrote to memory of 2912 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 33 PID 2932 wrote to memory of 2912 2932 541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe 33 PID 2828 wrote to memory of 1708 2828 7D57AD13E21.exe 35 PID 2828 wrote to memory of 1708 2828 7D57AD13E21.exe 35 PID 2828 wrote to memory of 1708 2828 7D57AD13E21.exe 35 PID 2828 wrote to memory of 1708 2828 7D57AD13E21.exe 35 PID 2828 wrote to memory of 1708 2828 7D57AD13E21.exe 35 PID 2828 wrote to memory of 1708 2828 7D57AD13E21.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe"C:\Users\Admin\AppData\Local\Temp\541ff61c291073ca55b5948d2a1892ffc00842de85cff147a9eb55bdc8fdd04cN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe" /f2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2908
-
-
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"C:\Users\Admin\AppData\Roaming\7D57AD13E21.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
-
C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"C:\Users\Admin\AppData\Roaming\Scegli_nome_allegato.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2912
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5a2f259ceb892d3b0d1d121997c8927e3
SHA16e0a7239822b8d365d690a314f231286355f6cc6
SHA256ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
SHA5125ae1b60390c94c9e79d3b500a55b775d82556e599963d533170b9f35ad5cfa2df1b7d24de1890acf8e1e2c356830396091d46632dbc6ee43a7d042d4facb5dad
-
Filesize
5.9MB
MD5431ecce8190ce8c6a4ce3b579ec14634
SHA1cc20587505482701395722900e6f5369d6672064
SHA256e33a3a7c1bdc7de646890492eba3eb0c1fcab991b21ef3e20f1ce03edfb30c8f
SHA512fcb706b16d62d66972e7049cd5d7ec829e3a2cd4515927a3f7da77b6ba8e9bd1a35a4db770ece3c8f402d531753a7187acb38620b450204a5655e2a0411be489