Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
Booking_56012.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Booking_56012.exe
Resource
win10v2004-20241007-en
General
-
Target
Booking_56012.exe
-
Size
206KB
-
MD5
83120f5a0cd8bcd617591ec021206a9c
-
SHA1
ca22698f2d51237c73251f96bf20debdcafd07b9
-
SHA256
0c9481d5e13d3244edc461205c3bdc7a5819302335e45127528f0724234774a8
-
SHA512
7e53d703b0f717ce499fd5ed0844cee005913bf3445add48cd32bada0f6bd0594996d2a362e534d8cc3881a61e889ff5e9e0ea7841e8fe62262f6f54a61972f2
-
SSDEEP
3072:K/nRNnCDDRvLGmrOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/oPYm21KLbDoU1sNj:ystvLGtELbMUTKZj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5912 dociv.exe -
Loads dropped DLL 6 IoCs
pid Process 2316 Booking_56012.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe 3868 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\ioiob = "C:\\Users\\Admin\\AppData\\Roaming\\ioiob.exe" Booking_56012.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\ioiozb = "C:\\Users\\Admin\\AppData\\Roaming\\ioiozb.exe" dociv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 5996 2316 WerFault.exe 30 3868 5912 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Booking_56012.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dociv.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2316 Booking_56012.exe 5912 dociv.exe 5912 dociv.exe 5912 dociv.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2316 Booking_56012.exe Token: SeDebugPrivilege 5912 dociv.exe Token: SeDebugPrivilege 2316 Booking_56012.exe Token: SeDebugPrivilege 5912 dociv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2316 wrote to memory of 5912 2316 Booking_56012.exe 31 PID 2316 wrote to memory of 5912 2316 Booking_56012.exe 31 PID 2316 wrote to memory of 5912 2316 Booking_56012.exe 31 PID 2316 wrote to memory of 5912 2316 Booking_56012.exe 31 PID 2316 wrote to memory of 5996 2316 Booking_56012.exe 32 PID 2316 wrote to memory of 5996 2316 Booking_56012.exe 32 PID 2316 wrote to memory of 5996 2316 Booking_56012.exe 32 PID 2316 wrote to memory of 5996 2316 Booking_56012.exe 32 PID 5912 wrote to memory of 3868 5912 dociv.exe 34 PID 5912 wrote to memory of 3868 5912 dociv.exe 34 PID 5912 wrote to memory of 3868 5912 dociv.exe 34 PID 5912 wrote to memory of 3868 5912 dociv.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\Booking_56012.exe"C:\Users\Admin\AppData\Local\Temp\Booking_56012.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\dociv.exe"C:\Users\Admin\AppData\Local\Temp\dociv.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 11763⤵
- Loads dropped DLL
- Program crash
PID:3868
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 13402⤵
- Program crash
PID:5996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5a9b2a704f9a861444e03cf570636b20c
SHA1941a008f6cfd986f5b347b7f9a0624d780c05dca
SHA2567225299b238bb77d77f2497b588469fb1dde1b385ac5da8cc8a3449b8c422d07
SHA512c19c3008ee28d259e344cd3a2f4ae7aef8627b3f27daf49049080bf18146a6b07276a5488ae4dbed1dd216f73c5585a43a647ab6fffe65a08673d0264091d668