Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
25s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe
Resource
win10v2004-20240802-en
General
-
Target
33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe
-
Size
94KB
-
MD5
6ce2458407f8d01cf4de84d6fd295400
-
SHA1
bd0a3b2dbb4719483c53372c46b58d1465bbd2f9
-
SHA256
33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1
-
SHA512
e77bcb50da2a01eec0e59ae32fbc622e3ab5b154bff800e457c24becbdf8f7ce80cddecc3cf46d7ac1ad4b2314f48bc46f7d37e311ad5f197bba70a0af0ffec4
-
SSDEEP
1536:VNoceSeJ0xgP5BgC6Vdv90Dw4WXJrLDc0Rz/gyzRZICrWaGZh7B:vRe465BgCuVG81U0Rz4CJrWNZ7
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2548 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2988 guifx.exe -
Loads dropped DLL 1 IoCs
pid Process 3028 33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Graphics = "\"C:\\ProgramData\\Graphics\\guifx.exe\" /run" 33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language guifx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2988 3028 33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe 30 PID 3028 wrote to memory of 2988 3028 33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe 30 PID 3028 wrote to memory of 2988 3028 33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe 30 PID 3028 wrote to memory of 2988 3028 33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe 30 PID 3028 wrote to memory of 2548 3028 33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe 31 PID 3028 wrote to memory of 2548 3028 33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe 31 PID 3028 wrote to memory of 2548 3028 33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe 31 PID 3028 wrote to memory of 2548 3028 33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe"C:\Users\Admin\AppData\Local\Temp\33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\ProgramData\Graphics\guifx.exe"C:\ProgramData\Graphics\guifx.exe" /run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2988
-
-
C:\windows\SysWOW64\cmd.exe"C:\windows\system32\cmd.exe" /c del /q "C:\Users\Admin\AppData\Local\Temp\33550ea11484aef85219b652befc49c8cf1f3afc108506ee8774221c7d274eb1N.exe" >> NUL2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5038ee33ea1ea352edc0d189a0f14b1f6
SHA1825e694691788907deb94b19a86564273f2285a1
SHA25627404b7a35fb93245da381855229fbeafa7dbb5354c14de40255edf02fe50dea
SHA51211a122c42c377d0777ee3890a598c4e862868710134da54134272617fb3444077c307def35dfd779e748f011377de0157dc007dadf562fac995c94a7b8f3df52