Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/12/2024, 17:04
Behavioral task
behavioral1
Sample
Server.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Server.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Server.exe
-
Size
93KB
-
MD5
bb3fb4c6cf26e4c493e408d0edb5e829
-
SHA1
88da923e8d993a87b8d8970b54f774b47e2b1dc1
-
SHA256
c52b9ffe033d174b2f93b44280c637e8fed9ec36cbf0a391c72a4e421830c6eb
-
SHA512
4d911914d49355b0ebe006b686dd6075b3ba1aa3aeb6425846cd5203d94683f33cbe44cadf909cd68577e404d628e0bfca6fa33b31dc2f668b5673d6446128c7
-
SSDEEP
1536:MO9r7EkrjaFIs7E5OxFJn8LjEwzGi1dD/DKgS:MOhjau5OfVni1dXP
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 2544 netsh.exe 2480 netsh.exe 2408 netsh.exe -
Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f660f38bbe0ae15ea88c354f03adbfdcWindows Update.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f660f38bbe0ae15ea88c354f03adbfdcWindows Update.exe Server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe Server.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe 1908 Server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1908 Server.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe Token: 33 1908 Server.exe Token: SeIncBasePriorityPrivilege 1908 Server.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2544 1908 Server.exe 30 PID 1908 wrote to memory of 2544 1908 Server.exe 30 PID 1908 wrote to memory of 2544 1908 Server.exe 30 PID 1908 wrote to memory of 2544 1908 Server.exe 30 PID 1908 wrote to memory of 2480 1908 Server.exe 32 PID 1908 wrote to memory of 2480 1908 Server.exe 32 PID 1908 wrote to memory of 2480 1908 Server.exe 32 PID 1908 wrote to memory of 2480 1908 Server.exe 32 PID 1908 wrote to memory of 2408 1908 Server.exe 33 PID 1908 wrote to memory of 2408 1908 Server.exe 33 PID 1908 wrote to memory of 2408 1908 Server.exe 33 PID 1908 wrote to memory of 2408 1908 Server.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2544
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2480
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2408
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5bb3fb4c6cf26e4c493e408d0edb5e829
SHA188da923e8d993a87b8d8970b54f774b47e2b1dc1
SHA256c52b9ffe033d174b2f93b44280c637e8fed9ec36cbf0a391c72a4e421830c6eb
SHA5124d911914d49355b0ebe006b686dd6075b3ba1aa3aeb6425846cd5203d94683f33cbe44cadf909cd68577e404d628e0bfca6fa33b31dc2f668b5673d6446128c7