Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
90s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 15:37
Behavioral task
behavioral1
Sample
c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe
Resource
win7-20240903-en
General
-
Target
c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe
-
Size
43KB
-
MD5
0aad3b74566b2e80599fa535e65801b3
-
SHA1
0a195ff96a4bb2fa1539db9c220ef3e1b2af3e7d
-
SHA256
c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8
-
SHA512
00ff3a06e20c603aa6bf77a2cf5674f2be495b653cb7abea5f65ace7da03d0344dcb344d6990b12325f98f84d4ba7e0aa7ba3d514038fe5ebfe2c3ccc9f9061e
-
SSDEEP
768:+U9XnKJv8KrtPNxT4oreP7cIK3yQpdk6x8pf9m4P/S0hVvIZiGDZ6RO8nHE8taqM:+U9abrtX4oocIK3yQkaY9z/S0hhy6k8u
Malware Config
Signatures
-
Sakula family
-
Sakula payload 4 IoCs
resource yara_rule behavioral1/memory/2112-12-0x0000000000FE0000-0x0000000000FFF000-memory.dmp family_sakula behavioral1/memory/2404-15-0x0000000000920000-0x000000000093F000-memory.dmp family_sakula behavioral1/memory/2112-23-0x0000000000FE0000-0x0000000000FFF000-memory.dmp family_sakula behavioral1/memory/2404-27-0x0000000000920000-0x000000000093F000-memory.dmp family_sakula -
Deletes itself 1 IoCs
pid Process 2656 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2404 MediaCenter.exe -
Loads dropped DLL 2 IoCs
pid Process 2112 c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe 2112 c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe -
resource yara_rule behavioral1/memory/2112-1-0x0000000000FE0000-0x0000000000FFF000-memory.dmp upx behavioral1/files/0x00080000000164db-4.dat upx behavioral1/memory/2404-11-0x0000000000920000-0x000000000093F000-memory.dmp upx behavioral1/memory/2112-12-0x0000000000FE0000-0x0000000000FFF000-memory.dmp upx behavioral1/memory/2404-15-0x0000000000920000-0x000000000093F000-memory.dmp upx behavioral1/memory/2112-23-0x0000000000FE0000-0x0000000000FFF000-memory.dmp upx behavioral1/memory/2404-27-0x0000000000920000-0x000000000093F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediaCenter.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2656 cmd.exe 2756 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2756 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2112 c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2404 2112 c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe 30 PID 2112 wrote to memory of 2404 2112 c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe 30 PID 2112 wrote to memory of 2404 2112 c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe 30 PID 2112 wrote to memory of 2404 2112 c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe 30 PID 2112 wrote to memory of 2656 2112 c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe 33 PID 2112 wrote to memory of 2656 2112 c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe 33 PID 2112 wrote to memory of 2656 2112 c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe 33 PID 2112 wrote to memory of 2656 2112 c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe 33 PID 2656 wrote to memory of 2756 2656 cmd.exe 35 PID 2656 wrote to memory of 2756 2656 cmd.exe 35 PID 2656 wrote to memory of 2756 2656 cmd.exe 35 PID 2656 wrote to memory of 2756 2656 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe"C:\Users\Admin\AppData\Local\Temp\c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2404
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\c3d410a0ff1f0f77f925a2098f7fca7df7bf7b2588120cbbbbc573f4248034f8.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2756
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5f225d35dc59d3d221026bbdf146e1001
SHA10f341a818cabe9b59faa8bdbedbea0d1c4b74dfb
SHA256301f3cc763432245b12d7445cfe42d221212e6f211d116b42b1faeb82c6d5ced
SHA512ccdedb797681431b6dc3ca8ffc2f4c4ebfb678414b13f278ed6511006e05d7a1a5f62cd3a601e79fd310c17c2e625bc471fb54363674b6fd8eab405ec2ecd927