Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
90s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe
Resource
win10v2004-20241007-en
General
-
Target
231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe
-
Size
272KB
-
MD5
5d2019b11efa06a03cf44a9014fbffe2
-
SHA1
04c40f1c947f13d417bbdc1ca5bbd9907c0ff859
-
SHA256
231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550
-
SHA512
c60e3c030597e4ac5e9b1ace29b4062659370cf1185b5415fe86d95b551caa7fa3a69e51e600e6dfe2fbbc30a3b1c4244da47910369f591e8e8de247971edd55
-
SSDEEP
6144:luupvQP0sP7wBfndGZ/1+UcJ0oVzQ6OCn9IAuE6eGni+FjpyObkF1:3I06kBf2/11cJ3xO6UE6eSiqlVwF1
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 8 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2828-68-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2828-70-0x0000000000400000-0x0000000000467000-memory.dmp family_cycbot behavioral1/memory/2028-73-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2028-71-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2828-186-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2036-190-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2828-389-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2828-393-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2936 84BA.tmp -
Loads dropped DLL 2 IoCs
pid Process 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\533.exe = "C:\\Program Files (x86)\\LP\\A500\\533.exe" 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2828-3-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2828-68-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2828-70-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/2028-73-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2028-71-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2828-186-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2036-188-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2036-190-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2828-389-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2828-393-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\A500\533.exe 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe File opened for modification C:\Program Files (x86)\LP\A500\533.exe 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe File opened for modification C:\Program Files (x86)\LP\A500\84BA.tmp 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84BA.tmp -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1744 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 2904 msiexec.exe Token: SeTakeOwnershipPrivilege 2904 msiexec.exe Token: SeSecurityPrivilege 2904 msiexec.exe Token: SeShutdownPrivilege 1744 explorer.exe Token: SeShutdownPrivilege 1744 explorer.exe Token: SeShutdownPrivilege 1744 explorer.exe Token: SeShutdownPrivilege 1744 explorer.exe Token: SeShutdownPrivilege 1744 explorer.exe Token: SeShutdownPrivilege 1744 explorer.exe Token: SeShutdownPrivilege 1744 explorer.exe Token: SeShutdownPrivilege 1744 explorer.exe Token: SeShutdownPrivilege 1744 explorer.exe Token: SeShutdownPrivilege 1744 explorer.exe Token: SeShutdownPrivilege 1744 explorer.exe Token: SeShutdownPrivilege 1744 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe 1744 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2028 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 31 PID 2828 wrote to memory of 2028 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 31 PID 2828 wrote to memory of 2028 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 31 PID 2828 wrote to memory of 2028 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 31 PID 2828 wrote to memory of 2036 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 33 PID 2828 wrote to memory of 2036 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 33 PID 2828 wrote to memory of 2036 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 33 PID 2828 wrote to memory of 2036 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 33 PID 2828 wrote to memory of 2936 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 36 PID 2828 wrote to memory of 2936 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 36 PID 2828 wrote to memory of 2936 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 36 PID 2828 wrote to memory of 2936 2828 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe 36 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe"C:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exeC:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe startC:\Users\Admin\AppData\Roaming\09A3C\733A5.exe%C:\Users\Admin\AppData\Roaming\09A3C2⤵PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exeC:\Users\Admin\AppData\Local\Temp\231fa8a7c6c6f1fbe1b9416bf19e1f9c6e09d5c815d14ebbf28692ae4571b550.exe startC:\Program Files (x86)\3C804\lvvm.exe%C:\Program Files (x86)\3C8042⤵PID:2036
-
-
C:\Program Files (x86)\LP\A500\84BA.tmp"C:\Program Files (x86)\LP\A500\84BA.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1744
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD568460bb3c994358d718cc0ece1583c8c
SHA1038f9ad56a0c2604df5f04927880e1e1bff4ce34
SHA256768b8aabf8b293e50967267f63258a40b91df9a9f27f0008a272f3b6d873aa36
SHA512eb31d879620557b25bdb9a388f7b51f7c4af6c3d6e2212b21c12bfe8334dff8179f75f9112dae285de45713f375232138b61a90aa925d3f155bbfda30782e5b5
-
Filesize
597B
MD55a1c854ae9aac5d260ea3ece71405702
SHA12afb02c7c79a119f9f14bc26f2e4d1c3741e1b4c
SHA256186d7be101b5ee376bf5223d02df051bafe1b2d6f0032264e66a086af5f87f8c
SHA512b90b5fdcd0d1e055da44b293e000ada58eac769b9ad0d8480247d07c4bf8a22689e081ecf8d6af9cf013af76cbc7f90dc53dd439461dc7c1c4460f757c0e3078
-
Filesize
897B
MD58b9e3f4c66fb4cd9e74c49db7f0bbb39
SHA11e8358eeda7e69301ccbab684df32e3f8d9ce715
SHA2568f843a29394d1cc2c2986dd6da85f7a15b67f9da4be0b9e831f35b216efd07fd
SHA5129b6d69af063a2d314c09d5603beb8f8c53c29189c8540024a22a51400f6045da63ffb12bb76eac82733dc52610de2a4341094a59595769e603a90444351470bb
-
Filesize
297B
MD5f35de969e48aeafe599485c0bb8a77f8
SHA1a13e667d2f138998fd8d84cd3b38584dfbe0f679
SHA2560e022b233d7359815c17c203beb3395c10e7332f5d47ccc50b239a8df8da7390
SHA512429d040fa55156fd62072d7d3c33b2126f2532e37e31502033206488a78a73ed6994f847791b8896f9d1d3a48d717d0ab3ec469c081bacac588e7c3dea93b044
-
Filesize
97KB
MD5cab43ad35f751376dc1ab8fc3ab7ac80
SHA1f3ac69c098e47f27e1694e3be74e3282c8cbd02f
SHA256555248b09ae00b6cce717d7033bb416fc0983b545d0eadba846105249a62295d
SHA5123b1383badd5d6b5bf9d517ab1a6729d4f5de3bfc10d8595e0582849b8d1504e87d71b3e3b104ba11162dd2727216de1f28324aa7d6b231a61725231e09406515