Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/01/2025, 06:33
Static task
static1
Behavioral task
behavioral1
Sample
2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe
Resource
win10v2004-20241007-en
General
-
Target
2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe
-
Size
272KB
-
MD5
cf7c5f8523446c33cc27330492313e50
-
SHA1
df91c2b5aebaed460065cc0a78f92cc2fb8d1490
-
SHA256
2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88e
-
SHA512
720ea22534d52a5e5989786baf959123105f99b96a0c1619a1bea1b9f9259773969a55006e81f449a34347bb19a48e0b584409ebb5c849c57b2576b19ad32843
-
SSDEEP
6144:luupvQP0sP7wBfndGZ/1+UcJ0oVzQ6OCn9IAuE6eGni+FjpyObkF:3I06kBf2/11cJ3xO6UE6eSiqlVwF
Malware Config
Signatures
-
Cycbot family
-
Detects Cycbot payload 7 IoCs
Cycbot is a backdoor and trojan written in C++.
resource yara_rule behavioral1/memory/2528-72-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2528-74-0x0000000000400000-0x0000000000467000-memory.dmp family_cycbot behavioral1/memory/2116-77-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2528-186-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/1144-190-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2528-377-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot behavioral1/memory/2528-382-0x0000000000400000-0x000000000046A000-memory.dmp family_cycbot -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe -
Pony family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2824 A42B.tmp -
Loads dropped DLL 2 IoCs
pid Process 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\013.exe = "C:\\Program Files (x86)\\LP\\3B10\\013.exe" 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral1/memory/2528-3-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2528-72-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2528-74-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/2116-77-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2116-76-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2528-186-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1144-190-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1144-188-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2528-377-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2528-382-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\3B10\013.exe 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe File opened for modification C:\Program Files (x86)\LP\3B10\A42B.tmp 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe File created C:\Program Files (x86)\LP\3B10\013.exe 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A42B.tmp -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2948 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeRestorePrivilege 2808 msiexec.exe Token: SeTakeOwnershipPrivilege 2808 msiexec.exe Token: SeSecurityPrivilege 2808 msiexec.exe Token: SeShutdownPrivilege 2948 explorer.exe Token: SeShutdownPrivilege 2948 explorer.exe Token: SeShutdownPrivilege 2948 explorer.exe Token: SeShutdownPrivilege 2948 explorer.exe Token: SeShutdownPrivilege 2948 explorer.exe Token: SeShutdownPrivilege 2948 explorer.exe Token: SeShutdownPrivilege 2948 explorer.exe Token: SeShutdownPrivilege 2948 explorer.exe Token: SeShutdownPrivilege 2948 explorer.exe Token: SeShutdownPrivilege 2948 explorer.exe Token: SeShutdownPrivilege 2948 explorer.exe Token: SeShutdownPrivilege 2948 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe 2948 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2116 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 31 PID 2528 wrote to memory of 2116 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 31 PID 2528 wrote to memory of 2116 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 31 PID 2528 wrote to memory of 2116 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 31 PID 2528 wrote to memory of 1144 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 33 PID 2528 wrote to memory of 1144 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 33 PID 2528 wrote to memory of 1144 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 33 PID 2528 wrote to memory of 1144 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 33 PID 2528 wrote to memory of 2824 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 36 PID 2528 wrote to memory of 2824 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 36 PID 2528 wrote to memory of 2824 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 36 PID 2528 wrote to memory of 2824 2528 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe 36 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe"C:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exeC:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe startC:\Users\Admin\AppData\Roaming\0A3D2\F8E3B.exe%C:\Users\Admin\AppData\Roaming\0A3D22⤵PID:2116
-
-
C:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exeC:\Users\Admin\AppData\Local\Temp\2625118880fa0a274e3647d40a8a17fee49bbe01a6ae8c444e4b4aa789d4d88eN.exe startC:\Program Files (x86)\D254A\lvvm.exe%C:\Program Files (x86)\D254A2⤵PID:1144
-
-
C:\Program Files (x86)\LP\3B10\A42B.tmp"C:\Program Files (x86)\LP\3B10\A42B.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2824
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2948
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f4f61574c8f1bbc9363439183f70e5bf
SHA197e2e9016a88359640ddc71c303d4464f8d587da
SHA256f95b5e4ed2e7b1487dc2c18d72eecd87621a6126d767d09bc8cff436b0e0310b
SHA51259585bb1f92e0eee4579b6fbf39e23fb5a36c8264794c0626277683c62a6deb0997f581551b2cb8b5c05517e819026851485154e7ca3f4df332016b6e6bf7881
-
Filesize
597B
MD50db2d86ab67728f3333e7fb8941aaf5c
SHA10ed74cb62f4b42d56769cc61c46208daee97b7c8
SHA2562d765e68026bd12f68cf10f78e994ac835cd80cc6093869f636cf1f7339187d6
SHA5127e8dec8e047729994e55d35cffc5c586f34cf17afc1287a51e92754ade0445e17207f745afaaa5d3452c1fdf2c570ed6e5632550b2e1fd7ad365ee458920edff
-
Filesize
297B
MD5f35de969e48aeafe599485c0bb8a77f8
SHA1a13e667d2f138998fd8d84cd3b38584dfbe0f679
SHA2560e022b233d7359815c17c203beb3395c10e7332f5d47ccc50b239a8df8da7390
SHA512429d040fa55156fd62072d7d3c33b2126f2532e37e31502033206488a78a73ed6994f847791b8896f9d1d3a48d717d0ab3ec469c081bacac588e7c3dea93b044
-
Filesize
897B
MD5d14ac4ad8dd5676f5605a8a6aaffab7d
SHA184fe436efdb367f32c9dc21d51d828b3ba0a7831
SHA2564a5eee2f2dde77db0f6614a7d29c424af3a8271a8ed9c76b94a6177015aeb57e
SHA5129c7df0d16b8395614b05a07ffde50a01b747c17ea50ea0b3bb2059ad186fe042d2e49ea40e66fe658ebe6a9ce98c7bb8d0a6ad7d8b2f6a10deef9a9e87eb5b7a
-
Filesize
97KB
MD5cab43ad35f751376dc1ab8fc3ab7ac80
SHA1f3ac69c098e47f27e1694e3be74e3282c8cbd02f
SHA256555248b09ae00b6cce717d7033bb416fc0983b545d0eadba846105249a62295d
SHA5123b1383badd5d6b5bf9d517ab1a6729d4f5de3bfc10d8595e0582849b8d1504e87d71b3e3b104ba11162dd2727216de1f28324aa7d6b231a61725231e09406515