Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/12/2024, 09:28
Behavioral task
behavioral1
Sample
8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe
Resource
win7-20240903-en
General
-
Target
8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe
-
Size
43KB
-
MD5
9c356dd81c8ca34d6d5b975f47cb45fb
-
SHA1
426a752efd01b708ba6088902fac16e31bca7edb
-
SHA256
8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3
-
SHA512
ece6576e6787853d8f759621772dc6b30881e783fcc522ca165ef63fac1188ecb57ad341af65289859f6b3ecbfa2f523752d6309faaba84e4f0adafe64d51275
-
SSDEEP
768:+U9XnKJv8KrtPNxT4oreP7cIK3yQpdk6x8pf9m4P/S0hVvIZiGDZ6RO8nHE8taqv:+U9abrtX4oocIK3yQkaY9z/S0hhy6k8R
Malware Config
Signatures
-
Sakula family
-
Sakula payload 5 IoCs
resource yara_rule behavioral1/memory/1900-1-0x00000000012A0000-0x00000000012BF000-memory.dmp family_sakula behavioral1/memory/1900-12-0x00000000012A0000-0x00000000012BF000-memory.dmp family_sakula behavioral1/memory/2380-15-0x0000000000250000-0x000000000026F000-memory.dmp family_sakula behavioral1/memory/1900-23-0x00000000012A0000-0x00000000012BF000-memory.dmp family_sakula behavioral1/memory/2380-30-0x0000000000250000-0x000000000026F000-memory.dmp family_sakula -
Deletes itself 1 IoCs
pid Process 2820 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2380 MediaCenter.exe -
Loads dropped DLL 2 IoCs
pid Process 1900 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe 1900 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe -
resource yara_rule behavioral1/memory/1900-1-0x00000000012A0000-0x00000000012BF000-memory.dmp upx behavioral1/files/0x0009000000018bf3-2.dat upx behavioral1/memory/2380-11-0x0000000000250000-0x000000000026F000-memory.dmp upx behavioral1/memory/1900-12-0x00000000012A0000-0x00000000012BF000-memory.dmp upx behavioral1/memory/2380-15-0x0000000000250000-0x000000000026F000-memory.dmp upx behavioral1/memory/1900-23-0x00000000012A0000-0x00000000012BF000-memory.dmp upx behavioral1/memory/2380-30-0x0000000000250000-0x000000000026F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediaCenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2820 cmd.exe 2800 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2800 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1900 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2380 1900 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe 30 PID 1900 wrote to memory of 2380 1900 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe 30 PID 1900 wrote to memory of 2380 1900 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe 30 PID 1900 wrote to memory of 2380 1900 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe 30 PID 1900 wrote to memory of 2820 1900 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe 33 PID 1900 wrote to memory of 2820 1900 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe 33 PID 1900 wrote to memory of 2820 1900 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe 33 PID 1900 wrote to memory of 2820 1900 8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe 33 PID 2820 wrote to memory of 2800 2820 cmd.exe 35 PID 2820 wrote to memory of 2800 2820 cmd.exe 35 PID 2820 wrote to memory of 2800 2820 cmd.exe 35 PID 2820 wrote to memory of 2800 2820 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe"C:\Users\Admin\AppData\Local\Temp\8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2380
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\8e98528d25912547aa90123827585ba7f0a9c096d999bffe4285263326e4a4c3.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2800
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD58c2ed17d64740919606bd3f80ac82937
SHA1b75911f4c4024f69b7756c15bba0d935272617cc
SHA25646059fae3994099460f448f8e735184fa05d380508426ac4ac6c693b6d35e66b
SHA51276ce517b6e7a3eb2cb82dda6d1b9129b08108276315188b394f1a02516bc53f9e1eec63c843c317e09efa4b0cfd737b2643ee97c43e4a60521619f8efcea0f3a