Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/10/2024, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe
Resource
win10v2004-20241007-en
General
-
Target
ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe
-
Size
56KB
-
MD5
69f240e70acf3f60d8717e01470153e0
-
SHA1
fe463a4c12999cd22aa9da6ccac962742d8fd94c
-
SHA256
ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253
-
SHA512
78fa72e5f3b7c5f01ed2f886001381bca0447abfaccfd9c5b0884c48b50796c573500f2ff195ad749c1f8a60d442df0a52f6a0703186efc5cb241a836b139b50
-
SSDEEP
768:+GjqkIbpGTCKT46FJ5AmrVPNqE96Duuz0JZBgYUW:+GmkIb8rZ1A6VPNJHuzz2
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{vr80039R-gt6q-4W2N-uyec-OC7GuJo0j0lB} ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{vr80039R-gt6q-4W2N-uyec-OC7GuJo0j0lB}\stubpath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows Firewall\\WIN32.exe" ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{vr80039R-gt6q-4W2N-uyec-OC7GuJo0j0lB}\ComponentID = "User Account Control" ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{vr80039R-gt6q-4W2N-uyec-OC7GuJo0j0lB}\ = "Microsoft Windows" ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe -
Executes dropped EXE 1 IoCs
pid Process 2036 svchost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Drivers = "C:\\Documents and Settings\\Albert\\Application Data\\Microsoft\\Local\\svchost.exe" ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Drivers = "C:\\Documents and Settings\\Albert\\Application Data\\Microsoft\\Local\\svchost.exe" ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Drivers = "C:\\Documents and Settings\\Albert\\Application Data\\Microsoft\\Local\\svchost.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Drivers = "C:\\Documents and Settings\\Albert\\Application Data\\Microsoft\\Local\\svchost.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2184 ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe 2184 ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2036 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2184 ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2184 ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe 2036 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2036 2184 ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe 31 PID 2184 wrote to memory of 2036 2184 ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe 31 PID 2184 wrote to memory of 2036 2184 ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe"C:\Users\Admin\AppData\Local\Temp\ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Documents and Settings\Albert\Application Data\Microsoft\Local\svchost.exe"C:\Documents and Settings\Albert\Application Data\Microsoft\Local\svchost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2036
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD569f240e70acf3f60d8717e01470153e0
SHA1fe463a4c12999cd22aa9da6ccac962742d8fd94c
SHA256ad6fc9949dd87ba65ccca4aafeeeafa98251429978c2e9207c3683c3e9019253
SHA51278fa72e5f3b7c5f01ed2f886001381bca0447abfaccfd9c5b0884c48b50796c573500f2ff195ad749c1f8a60d442df0a52f6a0703186efc5cb241a836b139b50