Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

3a29a6ce86...0N.exe

windows7-x64

10

3a29a6ce86...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2025, 06:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3a29a6ce8691f63227ccd3ef88c5335469239f61563e3ce125cd3d3ad07badd0N.exe

  • Size

    90KB

  • MD5

    bc81382662fdb3a0a785f26c8fff9b10

  • SHA1

    2d004acc6168ef54a4c027dd629d5195f383ac3b

  • SHA256

    3a29a6ce8691f63227ccd3ef88c5335469239f61563e3ce125cd3d3ad07badd0

  • SHA512

    e2c3018c6ce7cbf9609d5584e6c5237256473c48db3fe6a2bfcf0c7d32476fa781598f1d427128b2aa2fb84da9939a7f4e92b1e168c760395cf48c8fbbfb481e

  • SSDEEP

    1536:XRsjdLaslqdBXvTUL0Hnouy8VjVRsjdLaslqdBXvTUL0Hnouy8Vj:XOJKqsout9VOJKqsout9

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 7 IoCs
  • Modifies system executable filetype association 2 TTPs 13 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Drops file in System32 directory 6 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    evasion
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a29a6ce8691f63227ccd3ef88c5335469239f61563e3ce125cd3d3ad07badd0N.exe
    "C:\Users\Admin\AppData\Local\Temp\3a29a6ce8691f63227ccd3ef88c5335469239f61563e3ce125cd3d3ad07badd0N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4880
    • C:\Windows\xk.exe
      C:\Windows\xk.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4152
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4064
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1780
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:552
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3360
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4248
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2424

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
    Filesize

    90KB

    MD5

    2330ddf1dbea2ef165a42c6bf7dd405a

    SHA1

    e485e0484340055a4b17a4cd2e3da477e5139251

    SHA256

    8dd9e4f5677f0e5295f0d016940fb90bb25004cbed3d9a04db487baef9bc7187

    SHA512

    51e860f4717996256134e1ddc6ddffd5fb163eff69f14d4bb436a7743f8d57084460e2a9d7d82f6b3a476a59d991c8e2646a11f2c983f73033ff7ff85c61e7e8

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
    Filesize

    90KB

    MD5

    86bea522064faac1d773219d4a6974b1

    SHA1

    9967eff73f6b14991b35560d9e6f0381eaa38d25

    SHA256

    93038cd72028582536965d544465aaadb55a4861bf6a43eb5f54128c574d83e2

    SHA512

    4267cf04096360e43b7e4d30228db361934a4959f4dfddaf72d82916fd9f3a721d73ec523be2d2da745489d7d38b940f85f333a7c06fd0c9bf91ffb1d3d00142

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
    Filesize

    90KB

    MD5

    9026f73d373a96a5832b7ae966c93fd8

    SHA1

    273658b611d46cbf4815d89480d136ddcdd906d3

    SHA256

    5beb2d0f6c1aab7b6f35dd0dd2d64d2db61b087213a851ad9112cc6e433ff484

    SHA512

    987cd25e1a270892fdc84132550b750c2d3ebe2a6fe7e17f41f9475bf52fb6ade5fdadf77f1be450ec4e43eb91c8c111b9192988a45da5702d7d049b519e5839

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
    Filesize

    90KB

    MD5

    4fb0a1ce85810e248533577dcdfd0a8e

    SHA1

    961a61c312c51174d9bb0424e07bbc2dcf10afd7

    SHA256

    abf55c004c7d9c10bb160861ae00a1e97c7eaa781561b9f5554a40b881514b93

    SHA512

    bbc6975eea1ee1e8c9f1f5b951a15877a9792fc70150f0fe80019a522d41918e101833d6d52f2f064251d12062450d22e62e33bfe9e0bea910dcd83761aa12c9

    Download Submit

  • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
    Filesize

    90KB

    MD5

    34d7635d36b215a8c298da1174fb8892

    SHA1

    aa8bd3661ba592ca6403425cd8ef9ba9c4484a59

    SHA256

    9fe5600878a740bf9993c258c6db1f2771bf0af5350121ac4c9e48efbaa36fe0

    SHA512

    e020687abb5f76148b599bf642ed63b8e9800a598fd54e1c71ee2c26475a8ceb01f0149932a9add8a9a44cd93239f5f3ad27b92999abec7f0c2725160f39b11c

    Download Submit

  • C:\Users\Admin\AppData\Local\winlogon.exe
    Filesize

    90KB

    MD5

    bc81382662fdb3a0a785f26c8fff9b10

    SHA1

    2d004acc6168ef54a4c027dd629d5195f383ac3b

    SHA256

    3a29a6ce8691f63227ccd3ef88c5335469239f61563e3ce125cd3d3ad07badd0

    SHA512

    e2c3018c6ce7cbf9609d5584e6c5237256473c48db3fe6a2bfcf0c7d32476fa781598f1d427128b2aa2fb84da9939a7f4e92b1e168c760395cf48c8fbbfb481e

    Download Submit

  • C:\Windows\SysWOW64\IExplorer.exe
    Filesize

    90KB

    MD5

    d4ba1b262d91f9d56e0b8dace35a0286

    SHA1

    25f05c7255b421766dc22773db54124a6acee2e7

    SHA256

    4a9423c5bd45743cdb8f9e501ee3ddb2e9baff769a36498e244ef5df3df17aa5

    SHA512

    56f4c66aeaba5e8d5bb1040ff2810dad66386bc29800c7b1673cae37aeacc71033a4aed0c4fb9ec0a59f868dfb2defb5c47838a9413d471a8117493389ab8f65

    Download Submit

  • C:\Windows\xk.exe
    Filesize

    90KB

    MD5

    a739a71ed9e1cee4eacf99411c9a8be3

    SHA1

    ef63da2bb7422159d007d9ced9a9d1a8a2aa650e

    SHA256

    9278cecab054289998425991c3e906cf064272d4ad0569c7514e71b599b27b78

    SHA512

    ce051fa2ab1759d070dcd724e0774fd43c1b94d0ca0795409e8c5e04efd7ac3e40f1c9ff7b0266cefd8232d6588425b54483db445d08a9eafff8fcf70c8f9658

    Download Submit

  • memory/552-133-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1780-125-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2424-152-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3360-138-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/4064-120-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/4152-112-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/4248-145-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/4880-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/4880-153-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download