Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 16:55
Static task
static1
Behavioral task
behavioral1
Sample
4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe
Resource
win7-20241010-en
General
-
Target
4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe
-
Size
3.1MB
-
MD5
b236737a6d586c022e0bb342940b47c0
-
SHA1
28cbd0876e7f5edfa11f155cf4aae43ea0514160
-
SHA256
4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3a
-
SHA512
4bf386b6dc2189e2b66109fa231c0b5214bcae697a3a3b62dac1d477158fb47738ec24cf8bc6ddca95fa315979ee3474088e83745cd9059decb02b23e78073a7
-
SSDEEP
98304:c4x8xyqnWS3wiyiPMZBTZuU+EWnu55rBea:9gKSpyEMZNZuSPBea
Malware Config
Signatures
-
Floxif family
-
Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x000a000000012263-1.dat floxif -
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000a000000012263-1.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 2136 Setup.exe -
Loads dropped DLL 8 IoCs
pid Process 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe 2136 Setup.exe 2136 Setup.exe 2136 Setup.exe 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe 2136 Setup.exe 2136 Setup.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe -
resource yara_rule behavioral1/files/0x000a000000012263-1.dat upx behavioral1/memory/2196-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2136-109-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2136-153-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2196-186-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe File created \??\c:\program files\common files\system\symsrv.dll.000 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe 2136 Setup.exe 2136 Setup.exe 2136 Setup.exe 2136 Setup.exe 2136 Setup.exe 2136 Setup.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe Token: SeDebugPrivilege 2136 Setup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2136 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe 30 PID 2196 wrote to memory of 2136 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe 30 PID 2196 wrote to memory of 2136 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe 30 PID 2196 wrote to memory of 2136 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe 30 PID 2196 wrote to memory of 2136 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe 30 PID 2196 wrote to memory of 2136 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe 30 PID 2196 wrote to memory of 2136 2196 4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe"C:\Users\Admin\AppData\Local\Temp\4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\3c2b8d0b89afc9104dc209eae7\Setup.exeC:\3c2b8d0b89afc9104dc209eae7\\Setup.exe /x86 /x64 /lcid 20522⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD5326518603d85acd79a6258886fc85456
SHA1f1cef14bc4671a132225d22a1385936ad9505348
SHA256665797c7840b86379019e5a46227f888fa1a36a593ea41f9170ef018c337b577
SHA512f8a514efd70e81d0f2f983282d69040bca6e42f29aa5df554e6874922a61f112e311ad5d2b719b6ca90012f69965447fb91e8cd4103efb2453ff160a9062e5d3
-
Filesize
5KB
MD54288c2541843f75c348d825fc8b94153
SHA1e0dd8ed7bdb3c941a589361ee764f49a3619c264
SHA256c30a7597aa67e2847940e2c24f09b35c07b1ec759adbca7c8261141fc1ecca92
SHA5127ba9991fe4eed625fe7bef96a1d3ae70cb7616aad034236d1a2b346a08b48280cb6c20d2b059da9953919b0265125fe56dc5f4cc619ac653b4c1164ed564b359
-
Filesize
59KB
MD510da125eeabcbb45e0a272688b0e2151
SHA16c4124ec8ca2d03b5187ba567c922b6c3e5efc93
SHA2561842f22c6fd4caf6ad217e331b74c6240b19991a82a1a030a6e57b1b8e9fd1ec
SHA512d968abd74206a280f74bf6947757cca8dd9091b343203e5c2269af2e008d3bb0a17ff600eb961dbf69a93de4960133ade8d606fb9a99402d33b8889f2d0da710
-
Filesize
13KB
MD5bc3bc99d2b9db2ec02257514cf97109b
SHA18b2986cfa809b055a664f7fdbe9f54adf248cb4a
SHA256edd482f8b218af997219123348f2012999d857872bc111d6ebc14fd1a39ec12b
SHA5120cb60aa19d73f37bea7b7cfc03a8df712848aafc36a54eab52cb89625198e60864ca87d95540efdd85033e18b2472e4826aa6685d59a65120e4637e3c4fc2ddb
-
Filesize
15KB
MD5cd131d41791a543cc6f6ed1ea5bd257c
SHA1f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA256e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
SHA512a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
-
Filesize
146KB
MD51e7ffa70bcd3d78d7b2f9c4ba0a93242
SHA1c4b28df7b641869da780823bb8831de93494d169
SHA25651dfb446ecc2d97ad8c7aa585d821f404b6c053dd2bed436d158cd99cb194a34
SHA5126429ebf50602296435fd41135ea96b43dfa73a44034da4d012cfdab04537397e1a56357420d965f5f46af9c75adda6f1db6ec129b6b15fea842a5c41b7ae6c09
-
Filesize
788KB
MD584c1daf5f30ff99895ecab3a55354bcf
SHA17e25ba36bcc7deed89f3c9568016ddb3156c9c5a
SHA2567a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd
SHA512e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3
-
Filesize
288KB
MD5eb881e3dddc84b20bd92abcec444455f
SHA1e2c32b1c86d4f70e39de65e9ebc4f361b24ff4a1
SHA25611565d97287c01d22ad2e46c78d8a822fa3e6524561d4c02dfc87e8d346c44e7
SHA5125750cec73b36a3f19bfb055f880f3b6498a7ae589017333f6272d26f1c72c6f475a3308826268a098372bbb096b43fbd1e06e93eecc0a81046668228bc179a75
-
Filesize
29KB
MD52fadd9e618eff8175f2a6e8b95c0cacc
SHA19ab1710a217d15b192188b19467932d947b0a4f8
SHA256222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093
SHA512a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca
-
Filesize
40KB
MD50966fcd5a4ab0ddf71f46c01eff3cdd5
SHA18f4554f079edad23bcd1096e6501a61cf1f8ec34
SHA25631c13ecfc0eb27f34036fb65cc0e735cd444eec75376eea2642f926ac162dcb3
SHA512a9e70a2fb5a9899acf086474d71d0e180e2234c40e68bcadb9bf4fe145774680cb55584b39fe53cc75de445c6bf5741fc9b15b18385cbbe20fc595fe0ff86fce
-
Filesize
13KB
MD58a28b474f4849bee7354ba4c74087cea
SHA1c17514dfc33dd14f57ff8660eb7b75af9b2b37b0
SHA2562a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b
SHA512a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369
-
Filesize
38KB
MD5002b52d8a030fb5bc2e35c9d209ecd41
SHA1c4da0554a913a7a580c724d76ba2b1e13a598970
SHA25644e7de36e58052f79d6168e867c9edee5bd6632d6f7450b55e94b1c666c4789e
SHA51248a73976f797d3f83c722599e42135b550fe1f9479eede180403b2fda1c87da08e9176871f8ff017032a42046ac018eeb60c8e0b2c9fbc9e9f7a2d2f62cfb7da
-
Filesize
1KB
MD57e55ddc6d611176e697d01c90a1212cf
SHA1e2620da05b8e4e2360da579a7be32c1b225deb1b
SHA256ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed
SHA512283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e
-
Filesize
1KB
MD57d62e82d960a938c98da02b1d5201bd5
SHA1194e96b0440bf8631887e5e9d3cc485f8e90fbf5
SHA256ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5
SHA512ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67
-
Filesize
35KB
MD53d25d679e0ff0b8c94273dcd8b07049d
SHA1a517fc5e96bc68a02a44093673ee7e076ad57308
SHA256288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f
SHA5123bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255
-
Filesize
3KB
MD5514bfcd8da66722a9639eb41ed3988b7
SHA1cf11618e3a3c790cd5239ee749a5ae513b4205cd
SHA2566b8201ed10ce18ffade072b77c6d1fcaccf1d29acb47d86f553d9beebd991290
SHA51289f01c3361ba874015325007ea24e83ae6e73700996d0912695a4e7cb3f8a611494ba9d63f004dcd4f358821e756be114bcf0137ed9b130776a6e26a95382c7b
-
Filesize
141KB
MD53f0363b40376047eff6a9b97d633b750
SHA14eaf6650eca5ce931ee771181b04263c536a948b
SHA256bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c
SHA512537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8
-
Filesize
101KB
MD5b0075cee80173d764c0237e840ba5879
SHA1b4cf45cd5bb036f4f210dfcba6ac16665a7c56a8
SHA256ab18374b3aab10e5979e080d0410579f9771db888ba1b80a5d81ba8896e2d33a
SHA51271a748c82cc8b0b42ef5a823bac4819d290da2eddbb042646682bccc7eb7ab320afdcfdfe08b1d9eebe149792b1259982e619f8e33845e33eec808c546e5c829
-
Filesize
3.0MB
MD5aca1c250d44b47ad5c4c5ac039468eef
SHA167aa64e0e97597a9b17264b8ecaff40e18de5715
SHA25687b2c7367e353b5ab2a6d4756a03fba7c75d58664f56b0ea36a331c299a1724d
SHA5125ec7a4b5bb6d5b676649c3265b85d48a19ecab500319909448def6c390dca7b31cacb413e49be6ffb1cbdab157b1587d105dd2de29b4092ef18dea5057ce0cad
-
Filesize
76KB
MD5006f8a615020a4a17f5e63801485df46
SHA178c82a80ebf9c8bf0c996dd8bc26087679f77fea
SHA256d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be
SHA512c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76
-
Filesize
864KB
MD50d3ab03ae1010db8db5073eb4517f2c8
SHA12198038b627ae1a4e5fd2172e9faa93cc9436e0d
SHA256ab7a875ea7c8cb3305617c991fa780b65f14a7de1c373afd0cd11f3384a943a4
SHA5123bb28c1ff3014287826b86b470f5f26c8e8fcb9bb20289f30757d3ba1bf27774845553eb976187abd446f910ed1a51e36ae82fb384fcf1ea2bdfb58d388335c5
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab