Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 16:58
Static task
static1
Behavioral task
behavioral1
Sample
8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe
Resource
win10v2004-20241007-en
General
-
Target
8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe
-
Size
661KB
-
MD5
a1ee201a9e32983c7216a6345b5384b0
-
SHA1
d93849e60d73645a0b2817bd91d35d3519d7be2a
-
SHA256
8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0
-
SHA512
9dd8fdb68dde8529005ff12cb525f4d9753b15517d2efa1952e3cb42394bc1cbd9386d8ed38610368f6ffa58b5666af4e5d82948dc6f970564b5544d939d7a48
-
SSDEEP
12288:SIt104K8pV6yYP4rbpV6yYPg058KpV6yYPNUir2MhNl6zX3w9As/xO23WM6tJmDs:SIRW4XWleKWNUir2MhNl6zX3w9As/xOn
Malware Config
Extracted
berbew
http://viruslist.com/wcmd.txt
http://viruslist.com/ppslog.php
http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe -
Executes dropped EXE 1 IoCs
pid Process 2544 Bmenijcd.exe -
Loads dropped DLL 6 IoCs
pid Process 1720 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe 1720 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe 2756 WerFault.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Bmenijcd.exe 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe File created C:\Windows\SysWOW64\Diflambo.dll 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe File created C:\Windows\SysWOW64\Bmenijcd.exe 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2756 2544 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bmenijcd.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diflambo.dll" 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2544 1720 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe 30 PID 1720 wrote to memory of 2544 1720 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe 30 PID 1720 wrote to memory of 2544 1720 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe 30 PID 1720 wrote to memory of 2544 1720 8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe 30 PID 2544 wrote to memory of 2756 2544 Bmenijcd.exe 31 PID 2544 wrote to memory of 2756 2544 Bmenijcd.exe 31 PID 2544 wrote to memory of 2756 2544 Bmenijcd.exe 31 PID 2544 wrote to memory of 2756 2544 Bmenijcd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe"C:\Users\Admin\AppData\Local\Temp\8931f156e6e992c22f97bbaa6e6f11f793270197624659ad6eb948f7f5967ed0N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\Bmenijcd.exeC:\Windows\system32\Bmenijcd.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 1403⤵
- Loads dropped DLL
- Program crash
PID:2756
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD5ecb3cfcd87b298a93fea7ac323b233de
SHA1e74080af5d79f914fa0ba92b5714f7e7e2a4c5e1
SHA2562985a861eab5264761bf8915cc96432aaeafcb408aeec51e43d11c07c6b1aadd
SHA5121d3e1f265648014a56f673534322c88089eba095f18a8ff2d4be1cadc3cb2abe8d84e0317da6ebf8b78f372dbb19bd0e71283b2b375a6033797ccec506aeb9be