Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 08:00
Behavioral task
behavioral1
Sample
78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe
Resource
win10v2004-20241007-en
General
-
Target
78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe
-
Size
441KB
-
MD5
5c08ca135ff9d8316dd10845db00f635
-
SHA1
a24c9ccc818e192356169c409c265645e6f39824
-
SHA256
78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e
-
SHA512
a38b1c2db66416d96e966960ef394da048065f981d1386851581e43c579ebddc623bbfb4dac8a2079ddf1190ab3548e57a7b5abef6d0ca186aae438e84b0f9db
-
SSDEEP
6144:QZlBLpEu7eOhAF2QXcnzVRPYfmB8LVqv7IVuUmj+ZF6/BCrO6Kwc:QlpEu7eOhA7XcnzjYf+8LV2IVgj+Ep
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Executes dropped EXE 8 IoCs
pid Process 2680 wplayer.exe 2832 wplayer.exe 2328 wplayer.exe 2776 wplayer.exe 288 wplayer.exe 2064 wplayer.exe 2408 wplayer.exe 3052 wplayer.exe -
Loads dropped DLL 16 IoCs
pid Process 2796 78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe 2796 78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe 2680 wplayer.exe 2680 wplayer.exe 2832 wplayer.exe 2832 wplayer.exe 2328 wplayer.exe 2328 wplayer.exe 2776 wplayer.exe 2776 wplayer.exe 288 wplayer.exe 288 wplayer.exe 2064 wplayer.exe 2064 wplayer.exe 2408 wplayer.exe 2408 wplayer.exe -
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wplayer.exe wplayer.exe File opened for modification C:\Windows\SysWOW64\wplayer.exe wplayer.exe File created C:\Windows\SysWOW64\wplayer.exe wplayer.exe File created C:\Windows\SysWOW64\wplayer.exe wplayer.exe File created C:\Windows\SysWOW64\wplayer.exe wplayer.exe File opened for modification C:\Windows\SysWOW64\wplayer.exe 78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe File opened for modification C:\Windows\SysWOW64\wplayer.exe wplayer.exe File opened for modification C:\Windows\SysWOW64\wplayer.exe wplayer.exe File created C:\Windows\SysWOW64\wplayer.exe wplayer.exe File created C:\Windows\SysWOW64\wplayer.exe wplayer.exe File created C:\Windows\SysWOW64\wplayer.exe wplayer.exe File opened for modification C:\Windows\SysWOW64\wplayer.exe wplayer.exe File opened for modification C:\Windows\SysWOW64\wplayer.exe wplayer.exe File created C:\Windows\SysWOW64\wplayer.exe wplayer.exe File created C:\Windows\SysWOW64\wplayer.exe 78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe File opened for modification C:\Windows\SysWOW64\wplayer.exe wplayer.exe File created C:\Windows\SysWOW64\wplayer.exe wplayer.exe File opened for modification C:\Windows\SysWOW64\wplayer.exe wplayer.exe -
resource yara_rule behavioral1/memory/2796-0-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/files/0x000e000000012275-4.dat upx behavioral1/memory/2680-12-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2796-14-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2680-15-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2832-19-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2328-23-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2776-27-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2776-28-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/288-32-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/288-33-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2064-37-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/2408-41-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/3052-45-0x0000000000400000-0x00000000004AE000-memory.dmp upx behavioral1/memory/3052-46-0x0000000000400000-0x00000000004AE000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wplayer.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2680 2796 78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe 31 PID 2796 wrote to memory of 2680 2796 78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe 31 PID 2796 wrote to memory of 2680 2796 78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe 31 PID 2796 wrote to memory of 2680 2796 78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe 31 PID 2680 wrote to memory of 2832 2680 wplayer.exe 32 PID 2680 wrote to memory of 2832 2680 wplayer.exe 32 PID 2680 wrote to memory of 2832 2680 wplayer.exe 32 PID 2680 wrote to memory of 2832 2680 wplayer.exe 32 PID 2832 wrote to memory of 2328 2832 wplayer.exe 33 PID 2832 wrote to memory of 2328 2832 wplayer.exe 33 PID 2832 wrote to memory of 2328 2832 wplayer.exe 33 PID 2832 wrote to memory of 2328 2832 wplayer.exe 33 PID 2328 wrote to memory of 2776 2328 wplayer.exe 34 PID 2328 wrote to memory of 2776 2328 wplayer.exe 34 PID 2328 wrote to memory of 2776 2328 wplayer.exe 34 PID 2328 wrote to memory of 2776 2328 wplayer.exe 34 PID 2776 wrote to memory of 288 2776 wplayer.exe 35 PID 2776 wrote to memory of 288 2776 wplayer.exe 35 PID 2776 wrote to memory of 288 2776 wplayer.exe 35 PID 2776 wrote to memory of 288 2776 wplayer.exe 35 PID 288 wrote to memory of 2064 288 wplayer.exe 36 PID 288 wrote to memory of 2064 288 wplayer.exe 36 PID 288 wrote to memory of 2064 288 wplayer.exe 36 PID 288 wrote to memory of 2064 288 wplayer.exe 36 PID 2064 wrote to memory of 2408 2064 wplayer.exe 38 PID 2064 wrote to memory of 2408 2064 wplayer.exe 38 PID 2064 wrote to memory of 2408 2064 wplayer.exe 38 PID 2064 wrote to memory of 2408 2064 wplayer.exe 38 PID 2408 wrote to memory of 3052 2408 wplayer.exe 39 PID 2408 wrote to memory of 3052 2408 wplayer.exe 39 PID 2408 wrote to memory of 3052 2408 wplayer.exe 39 PID 2408 wrote to memory of 3052 2408 wplayer.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe"C:\Users\Admin\AppData\Local\Temp\78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\wplayer.exeC:\Windows\system32\wplayer.exe 468 "C:\Users\Admin\AppData\Local\Temp\78479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\wplayer.exeC:\Windows\system32\wplayer.exe 520 "C:\Windows\SysWOW64\wplayer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\wplayer.exeC:\Windows\system32\wplayer.exe 524 "C:\Windows\SysWOW64\wplayer.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\wplayer.exeC:\Windows\system32\wplayer.exe 528 "C:\Windows\SysWOW64\wplayer.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\wplayer.exeC:\Windows\system32\wplayer.exe 532 "C:\Windows\SysWOW64\wplayer.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Windows\SysWOW64\wplayer.exeC:\Windows\system32\wplayer.exe 536 "C:\Windows\SysWOW64\wplayer.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\wplayer.exeC:\Windows\system32\wplayer.exe 540 "C:\Windows\SysWOW64\wplayer.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\wplayer.exeC:\Windows\system32\wplayer.exe 544 "C:\Windows\SysWOW64\wplayer.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3052
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
441KB
MD55c08ca135ff9d8316dd10845db00f635
SHA1a24c9ccc818e192356169c409c265645e6f39824
SHA25678479f94f0e31b0c332314cf0c398dcffe9c2db6a1972b079957ac6a8be1810e
SHA512a38b1c2db66416d96e966960ef394da048065f981d1386851581e43c579ebddc623bbfb4dac8a2079ddf1190ab3548e57a7b5abef6d0ca186aae438e84b0f9db