Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2706e6516e...75.exe

windows7-x64

7

2706e6516e...75.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/02/2025, 20:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2706e6516e6f2096e97947c061554a30c15df25b323f8d8ef26a83498d16d475.exe

  • Size

    772KB

  • MD5

    11efce84e0a22a7cf2cc37e4d70b9d12

  • SHA1

    fdf14b95fe44f020456008604cd31536e423b72b

  • SHA256

    2706e6516e6f2096e97947c061554a30c15df25b323f8d8ef26a83498d16d475

  • SHA512

    a3ff129fc550c5bc126984d14f0c7cbea78b466636be8608004a30a22d5d179d2e52301015b3e7d9df6fe3455fa7c27fc863e927f1fda4e00b90bee7482c8c15

  • SSDEEP

    12288:gmhjJdUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxCiZ:Xh1alj3DSudvGM3MXTVhtSQWGtx3Z

Score
7/10
discoveryupx

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 14 IoCs
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 11 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Connections Discovery 1 TTPs 2 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\smss.exe
    \SystemRoot\System32\smss.exe
    1⤵
      PID:256
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\2706e6516e6f2096e97947c061554a30c15df25b323f8d8ef26a83498d16d475.exe
        "C:\Users\Admin\AppData\Local\Temp\2706e6516e6f2096e97947c061554a30c15df25b323f8d8ef26a83498d16d475.exe"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1576
        • C:\Users\Admin\AppData\Local\Temp\hangmdjrki.exe
          "C:\Users\Admin\AppData\Local\Temp\hangmdjrki.exe" "C:\Users\Admin\AppData\Local\Temp\cjgmqjekhl.exe" "C:\Users\Admin\AppData\Local\Temp\2706e6516e6f2096e97947c061554a30c15df25b323f8d8ef26a83498d16d475.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2264
          • C:\Users\Admin\AppData\Local\Temp\2706e6516e6f2096e97947c061554a30c15df25b323f8d8ef26a83498d16d475.exe
            "C:\Users\Admin\AppData\Local\Temp\2706e6516e6f2096e97947c061554a30c15df25b323f8d8ef26a83498d16d475.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:324
        • C:\Users\Admin\AppData\Local\Temp\gzpcetomeu.exe
          C:\Users\Admin\AppData\Local\Temp\gzpcetomeu.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1760
          • C:\Windows\System32\cmd.exe
            /c sc config msdtc obj= LocalSystem
            4⤵
              PID:2664
              • C:\Windows\system32\sc.exe
                sc config msdtc obj= LocalSystem
                5⤵
                • Launches sc.exe
                PID:2680
            • C:\Windows\system32\cmd.exe
              cmd /c "C:\Users\Admin\AppData\Local\Temp\dbHAiHVM.bat"
              4⤵
                PID:2604
              • C:\Windows\System32\bindsvc.exe
                "C:\Windows\System32\bindsvc.exe"
                4⤵
                • Executes dropped EXE
                PID:2324
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Loads dropped DLL
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2800
          • C:\Windows\system32\SearchUserHost.exe
            C:\Windows\system32\SearchUserHost.exe
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2228
            • C:\Windows\system32\cmd.exe
              /c systeminfo
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2612
              • C:\Windows\system32\systeminfo.exe
                systeminfo
                4⤵
                • Gathers system information
                PID:2028
            • C:\Windows\system32\cmd.exe
              /c "tasklist /v"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2120
              • C:\Windows\system32\tasklist.exe
                tasklist /v
                4⤵
                • Enumerates processes with tasklist
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2184
            • C:\Windows\system32\cmd.exe
              /c "netstat -ano"
              3⤵
              • System Network Connections Discovery
              • Suspicious use of WriteProcessMemory
              PID:2868
              • C:\Windows\system32\NETSTAT.EXE
                netstat -ano
                4⤵
                • System Network Connections Discovery
                • Gathers network information
                • Suspicious use of AdjustPrivilegeToken
                PID:760
            • C:\Windows\system32\cmd.exe
              /c "ipconfig /all"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:932
              • C:\Windows\system32\ipconfig.exe
                ipconfig /all
                4⤵
                • Gathers network information
                PID:544
            • C:\Windows\system32\cmd.exe
              /c "route print"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1536
              • C:\Windows\system32\ROUTE.EXE
                route print
                4⤵
                  PID:3048
              • C:\Windows\system32\cmd.exe
                /c "arp -a"
                3⤵
                • Network Service Discovery
                • Suspicious use of WriteProcessMemory
                PID:1540
                • C:\Windows\system32\ARP.EXE
                  arp -a
                  4⤵
                  • Network Service Discovery
                  PID:1756
              • C:\Windows\system32\cmd.exe
                /c "tasklist /m msfte.dll"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2068
                • C:\Windows\system32\tasklist.exe
                  tasklist /m msfte.dll
                  4⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1876
              • C:\Windows\system32\cmd.exe
                /c "net share"
                3⤵
                  PID:316
                  • C:\Windows\system32\net.exe
                    net share
                    4⤵
                      PID:1496
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 share
                        5⤵
                          PID:1872
                    • C:\Windows\system32\cmd.exe
                      /c "ping server"
                      3⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      PID:2444
                      • C:\Windows\system32\PING.EXE
                        ping server
                        4⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:1596
                    • C:\Windows\system32\cmd.exe
                      /c "sc query hfile.sys"
                      3⤵
                        PID:2728
                        • C:\Windows\system32\sc.exe
                          sc query hfile.sys
                          4⤵
                          • Launches sc.exe
                          PID:2624
                    • C:\Windows\system32\SearchProtocolHost.exe
                      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:2052
                    • C:\Windows\system32\SearchFilterHost.exe
                      "C:\Windows\system32\SearchFilterHost.exe" 0 544 548 556 65536 552
                      2⤵
                      • Loads dropped DLL
                      • Modifies data under HKEY_USERS
                      PID:1040

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                    Filesize

                    1024KB

                    MD5

                    39a8758fe114de92440380a2443303dd

                    SHA1

                    c88bc6d65bb530045f4612d754968b697b771ab7

                    SHA256

                    611cf970c61d319f35bed7bde6afec882f4097c9fad98273a7e6419f51b887e9

                    SHA512

                    d5334865b517f23021ce0b17adb4eb87b157d238c54c6298dd1dd04235815c8a5c2cb9e05b7fa2ff59de62bea9b304eea827d8a9169dc09bfc37fbb6705858c6

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\cjgmqjekhl.exe
                    Filesize

                    65KB

                    MD5

                    f13ec8a783e0cb0d6dc26a3ca848b7b8

                    SHA1

                    6107fb5303a7a886f6f2674fb73c543696779dac

                    SHA256

                    0809e3b71709f1343086eeb6c820543c1a7119e74eef8ac1aee1f81093abec66

                    SHA512

                    d6d060ff085e3d51b90c913a016ffee9c0266ab2a3a8113abd30d1d9e876652078d9980b1d3a37d8f70c2407c4434df4f64b5c6a6f111b910bb7bf7a4e36f579

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\dbHAiHVM.bat
                    Filesize

                    196B

                    MD5

                    75f59bbf1d6e89781d92e7090f7fcf03

                    SHA1

                    b5c914e4d2b75357417f5647f91b7dda4f6d0f66

                    SHA256

                    5c4404fa03a0e87b14059f23dbaa141dc68ff8cdbf9037c8b012c2f0d83634d7

                    SHA512

                    f661bd54c44104cecf04108fa78cadaf1a091b14eb483fdad6ec3c691394600dff256cda16ae2b595ae3d04574c7501dd0a35520a7d89745179464a697158717

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\gzpcetomeu.exe
                    Filesize

                    580KB

                    MD5

                    2c2029588ad8b86759c17b7ae885ee03

                    SHA1

                    91653b5344d4c210201218e2f215dd5228d76799

                    SHA256

                    3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290

                    SHA512

                    88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
                    Filesize

                    1KB

                    MD5

                    a5a2226025a98c429c0386a6c5ba5c4c

                    SHA1

                    d0e7ce0b0d3eb45ace12874444a49b4a30e75e12

                    SHA256

                    cb5e068a1d4d89d917ce3266f01ac8f2b4921fb97e6e87a0e430f57436e953e5

                    SHA512

                    5592f20379fc8c321e0031db063d0a24e0c091ea15b2d44bbad82f9bd8a893756ab80062b3b74e1dab5a3146e5db29e67312e5e225dce84182b488ca99ebcfcf

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\hangmdjrki.exe
                    Filesize

                    51KB

                    MD5

                    e48b89715bf5e4c55eb5a1fed67865d9

                    SHA1

                    89a287da39e14b02cdc284eb287549462346d724

                    SHA256

                    c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e

                    SHA512

                    4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c

                    Download Submit

                  • \Windows\System32\SearchUserHost.exe
                    Filesize

                    244KB

                    MD5

                    42ec9065d9bf266ade924b066c783a56

                    SHA1

                    a8dcf7d63a8bb5abef8787775957a5bb6c0f3f77

                    SHA256

                    4ac002e90a52cb0998da78f2995294ee77b89fb2be709b0e3c8e1627212bccdc

                    SHA512

                    e49af43aef3f02397098821b81e034ee1f07f8c2f49a9a1768d1522bbc009103a2c88f436f488333f57c7d56b34acbee84588040f56382cc75eaddbb9db19980

                    Download Submit

                  • \Windows\System32\bindsvc.exe
                    Filesize

                    291KB

                    MD5

                    7c5b397fb54d5aa06bd2a6fb99c62fee

                    SHA1

                    a9e0bf7bbabf6ab9e294156985537ae972ebd743

                    SHA256

                    d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee

                    SHA512

                    daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c

                    Download Submit

                  • \Windows\System32\msfte.dll
                    Filesize

                    217KB

                    MD5

                    d7ddfd90c55ad42200b2a7e51110ad87

                    SHA1

                    0c9429f0b51a73423de4cb0ecf10fd3b3bacd84d

                    SHA256

                    4fdc7aacb3981434e797106944f27a507201d11cdf194b3fab79747ce98f2446

                    SHA512

                    8ba6cd56ce6aeae9481154e93b75d8712e854a19c60f6279abf721c2550a09d9f22cb410a5cc3062d59f17cde35e728d250129abe60f29321a16df7d2fb9c179

                    Download Submit

                  • memory/1196-38-0x00000000021B0000-0x00000000021B1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1576-20-0x0000000002D30000-0x0000000002EAA000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/1760-179-0x00000000010F0000-0x000000000126A000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/1760-195-0x00000000010F0000-0x000000000126A000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/1760-27-0x00000000010F0000-0x000000000126A000-memory.dmp

                    Filesize

                    1.5MB

                    Download

                  • memory/2800-121-0x0000000003450000-0x0000000003458000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2800-86-0x0000000001130000-0x0000000001138000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2800-87-0x0000000001070000-0x0000000001071000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2800-155-0x0000000003CF0000-0x0000000003CF8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2800-169-0x0000000003FA0000-0x0000000003FA8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2800-170-0x0000000003F90000-0x0000000003F91000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2800-177-0x0000000003F90000-0x0000000003F98000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2800-104-0x0000000001140000-0x0000000001148000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2800-42-0x0000000001E10000-0x0000000001E20000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2800-59-0x0000000001F20000-0x0000000001F30000-memory.dmp

                    Filesize

                    64KB

                    Download

                  • memory/2800-95-0x0000000000F30000-0x0000000000F31000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2800-93-0x0000000001070000-0x0000000001078000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2800-212-0x00000000044B0000-0x00000000044B1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2800-219-0x00000000044C0000-0x00000000044C8000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2800-247-0x0000000001780000-0x0000000001788000-memory.dmp

                    Filesize

                    32KB

                    Download

                  • memory/2800-248-0x0000000001770000-0x0000000001771000-memory.dmp

                    Filesize

                    4KB

                    Download