Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/12/2024, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
General
-
Target
file.exe
-
Size
5.6MB
-
MD5
260373b0281173d7a116e4a54e361425
-
SHA1
38a2a60736c19436b2eaf783b9ae92838cc750c8
-
SHA256
36badaade40faa02d430c40eafd4a6bad3d0c3289c9435ddcf4930301f029755
-
SHA512
98cc8704e6e2597c3776408adcd9ce52a09ae64f43dd310b750bfaf4f6a558b0e3f042ccdd6be863a4ec6df4d63092a4390cd186fbb28dd423e27653cc71182d
-
SSDEEP
98304:aGl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Uc:adOuK6mn9NzgMoYkSIvUcwti7TQlvciE
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2608 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2400 file.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier file.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2400 file.exe 2400 file.exe 2400 file.exe 2400 file.exe 2400 file.exe 2400 file.exe 2400 file.exe 2400 file.exe 2400 file.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2400 file.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2608 2400 file.exe 31 PID 2400 wrote to memory of 2608 2400 file.exe 31 PID 2400 wrote to memory of 2608 2400 file.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp2961.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp2961.tmp.bat2⤵
- Deletes itself
PID:2608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172B
MD52f2ccaeb9dc8b41245fb55d0cd7519b1
SHA1eb3e8e817790e3914d5dd25dea57be55c4736489
SHA25646b55f7d1e7765e7488f1163d2277fc62d34d6e45453c833626972e610b0a7df
SHA51298a74777c5b8153a990cd3dec7f9257065f1dfb930eebfa8bfcde3b6c7fe084e248131a6311d0094ef12a05f7cd4800e386373ae7a11e6c5d29f63b886f663cb
-
Filesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
Filesize
92KB
MD52cd7a684788f438d7a7ae3946df2e26f
SHA13e5a60f38395f3c10d9243ba696468d2bb698a14
SHA2562ebed8dd3531958e857c87ddbf46376b8a10ea2f364d2399d9fcc604da0bee1d
SHA5120fec4b36e2173d1ad5eca880e1be1d0c7093d459aeb612d371e4ac92fbeaea55beb36e9228d36d57fe1851bd4d57b26dd5b8edb4620fb17b91441e840669c7d1
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
1.7MB
MD565ccd6ecb99899083d43f7c24eb8f869
SHA127037a9470cc5ed177c0b6688495f3a51996a023
SHA256aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4
SHA512533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d