Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
90s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe
Resource
win7-20240903-en
General
-
Target
e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe
-
Size
204KB
-
MD5
01bc91f4f37d84c72a6fd882c9084170
-
SHA1
3bb95b79646e9acbdb7b869c1b3d3f2b0a110496
-
SHA256
e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2
-
SHA512
529c5a3a13b93a5bee2c56f562275b4ed25dff3541fcd533cc9b9a109f75058abe9e710aec83f2ca06f14a318fb7c3f9430ca0b409e4fd351cf5e16a7db64b6d
-
SSDEEP
3072:ex2smNha00myg3m4zGMejNGBSNLM8snYr3ZV3DFoTYS39YLCpg1kAz2mLa:FNhKmErjPVM8snQ3z3DD89YL06JvL
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\desktoplayer.exe" svchost.exe -
Ramnit family
-
Executes dropped EXE 2 IoCs
pid Process 1616 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe 2072 DesktopLayer.exe -
Loads dropped DLL 4 IoCs
pid Process 2584 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe 2584 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe 1616 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe 1616 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
resource yara_rule behavioral1/memory/2072-27-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2072-25-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1616-23-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1616-12-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2072-51-0x0000000000400000-0x0000000000415000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\msadc\msadcfr.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\sunmscapi.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Utilities.v3.5.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libstats_plugin.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll svchost.exe File opened for modification C:\Program Files\Internet Explorer\networkinspection.dll svchost.exe File opened for modification C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\mozglue.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\WMPDMC.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\hprof.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll svchost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\libGLESv2.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Linq.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libripple_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Defender\MsMpRes.dll svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe svchost.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Net.Resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Media Player\wmpnssci.dll svchost.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadcer.dll svchost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll svchost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll svchost.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE svchost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPCEXT.DLL svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html svchost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DesktopLayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2072 DesktopLayer.exe 2072 DesktopLayer.exe 2072 DesktopLayer.exe 2072 DesktopLayer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2584 wrote to memory of 1616 2584 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe 31 PID 2584 wrote to memory of 1616 2584 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe 31 PID 2584 wrote to memory of 1616 2584 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe 31 PID 2584 wrote to memory of 1616 2584 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe 31 PID 1616 wrote to memory of 2072 1616 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe 32 PID 1616 wrote to memory of 2072 1616 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe 32 PID 1616 wrote to memory of 2072 1616 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe 32 PID 1616 wrote to memory of 2072 1616 e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe 32 PID 2072 wrote to memory of 2708 2072 DesktopLayer.exe 33 PID 2072 wrote to memory of 2708 2072 DesktopLayer.exe 33 PID 2072 wrote to memory of 2708 2072 DesktopLayer.exe 33 PID 2072 wrote to memory of 2708 2072 DesktopLayer.exe 33 PID 2072 wrote to memory of 2708 2072 DesktopLayer.exe 33 PID 2072 wrote to memory of 2708 2072 DesktopLayer.exe 33 PID 2072 wrote to memory of 2708 2072 DesktopLayer.exe 33 PID 2072 wrote to memory of 2708 2072 DesktopLayer.exe 33 PID 2072 wrote to memory of 2708 2072 DesktopLayer.exe 33 PID 2072 wrote to memory of 2708 2072 DesktopLayer.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe"C:\Users\Admin\AppData\Local\Temp\e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exeC:\Users\Admin\AppData\Local\Temp\e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2708
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
Filesize116KB
MD569da173048583b96301cb479a59fa57b
SHA11f5e247b5cb080c5a77ba7769f7f7110b35e9a34
SHA256e0dd89af3f7b3db2e6d70b8eb10b6def096337c2ce21db60cb5773b071a699eb
SHA512d3ab8a5842b6b1ec048193f7330701639e579d3581d12ae63097070e05da6107be9465fc2ddfd0248d0da51030c3d145396d5cc99b3f59092a0d58597d5df369
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
Filesize113KB
MD5edec2fa704066a3ad1bfbf05b4544a49
SHA1f45b82d4b20082630af1a0fcd6d2ee900b1d8007
SHA256b5b8778a6fc8f6ab25376161ab84fe9ad7bc4266c19ec09a59bd2cec457aa5db
SHA512306d672f88fb28621f056326fd11b0038fa76c98693335ececd90e5d2500f7cc5e1144c39801cf23d959430340e8c93ad551885e11e7f9f8e9f7791280c02eca
-
C:\Users\Admin\AppData\Local\Temp\e029495bc7faa2bd3402d58c418b25acc7644fb136d517c04f1d54df8391f4a2NSrv.exe
Filesize52KB
MD5a3e0fcd3f20ce9325284213684768a40
SHA11d523885a94c71659135bb1091e7b2e30a0e8a1b
SHA256542fe44cc87cc6ab352994f51bcaa179a63c18e342a1e5b4beaad3225fae132f
SHA51235ecd3fa6aabac8dca3922932e49b9bd11c82f2606dc391d1dc2b39bde110bab6dde941d30004670dc86e9cb8c29209374e09e955f4a975fa183393f89f61143