Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe
Resource
win10v2004-20240802-en
General
-
Target
999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe
-
Size
46KB
-
MD5
b71825b72e712c35abad5bd272fccbbb
-
SHA1
f981e3296242b0af200d098b89f9a25e102c1cce
-
SHA256
999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52
-
SHA512
e825434f76279b273fb4d3459258a47af22397f67bb8558ac8a8a95a3cea6b40ff9a3fcd6fca2a30fd068c3e484ffa9c5d5ca964fcf3d1bcf7f1998502d59f05
-
SSDEEP
768:ueKHbBtL8FFswCSpj2/sWYOh5Ti9to8Qm/O+3yVX7DvQzTGfLE:y7BtLsFrC0jVhOK9VV2/fQn
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3020 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 2032 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe 2032 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\e52ec025\jusched.exe 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe File created C:\Program Files (x86)\e52ec025\e52ec025 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Update23.job 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2032 wrote to memory of 3020 2032 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe 30 PID 2032 wrote to memory of 3020 2032 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe 30 PID 2032 wrote to memory of 3020 2032 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe 30 PID 2032 wrote to memory of 3020 2032 999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe"C:\Users\Admin\AppData\Local\Temp\999fa14f19d0882319f62ccabfcb92a9de1c098f3625316081a920df49fb5a52.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files (x86)\e52ec025\jusched.exe"C:\Program Files (x86)\e52ec025\jusched.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17B
MD52130fee70fc3f7c10d5279f96f98ad1e
SHA14307cef89171fa230048ea22546802198d888780
SHA2563506e286f6223ccaf1665d4e457b712abeb527266ff28327ce60e37b9fbeb404
SHA51267fa1bb31028ff3ba125f184207499b9205f58c9eef2ac948f5824475515c396b3d5f93e207cb96deffe1aedb286b1f935cc689c5d84449e51c517da1cffe2e5
-
Filesize
46KB
MD51f1b1457642f1d672b5a75392d983424
SHA118a1d2967fa36ed10664501d043df72940d45e7f
SHA256c3f78a49374fd869c4caadddd67ec53c4ad6c4866ae2c433522c9d432c5dc44a
SHA5124c566c4a5ff0eee59720ddec2000b294280688caa14fb2b3909b573a20566fd620ab1fe9757d60257a643091f16238f7c3ea281066f43f7da7f83d6d75bd9f59