Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 03:06
Static task
static1
Behavioral task
behavioral1
Sample
911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe
Resource
win10v2004-20241007-en
General
-
Target
911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe
-
Size
336KB
-
MD5
18bce6958077daf445b4eb73e492c180
-
SHA1
2b0f9d6e65dfa4aaa51d8106d7aad6582bb17c13
-
SHA256
911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750c
-
SHA512
2136ab61473432db9d91fb2af22943bb218d00f19d2e47e69b40fc0bc6f52dc3431f60a56db380f1629c6527ea6e65172e4a1df5d1f30ecf696157a2c8e78d41
-
SSDEEP
6144:nyH7xOc6H5c6HcT66vlmaoqELocFeEx8rKCTH6kTWa:naxELocDIPTZT1
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1868 svchost.exe 2652 911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe 2708 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 1868 svchost.exe 1868 svchost.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe 911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2468 wrote to memory of 1868 2468 911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe 30 PID 2468 wrote to memory of 1868 2468 911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe 30 PID 2468 wrote to memory of 1868 2468 911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe 30 PID 2468 wrote to memory of 1868 2468 911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe 30 PID 1868 wrote to memory of 2652 1868 svchost.exe 31 PID 1868 wrote to memory of 2652 1868 svchost.exe 31 PID 1868 wrote to memory of 2652 1868 svchost.exe 31 PID 1868 wrote to memory of 2652 1868 svchost.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe"C:\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe"C:\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2652
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
-
\Users\Admin\AppData\Local\Temp\911d2d604559e2da7e18f03c1d610fb759ba1d7d947ad844d1c0ef473fac750cN.exe
Filesize300KB
MD5da112b01ca1a498da4faa148f19dfd06
SHA1621e1e0dd5af13a189d982b8eb23db142353c4d0
SHA2568dce2756a77db5163c5d575c34750fc58119d5e1827108348a90f69015be8ca6
SHA5129ddca81114443ee2299b6a3dc745cb37168402200ab77a178e3b5f32c263cdf22eeb879c560cd4dd1ee1ea9b90abd9632cf5ba45ae08933a48be372a33c32d29