Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7 -
submitted
09/07/2020, 11:14
Static task
static1
Behavioral task
behavioral1
Sample
22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe
-
Size
193KB
-
MD5
5cfacc34c063d14b2a10e99b1512c532
-
SHA1
b505a5c20a3aa8ed1ceba82442787fa44f4caf1a
-
SHA256
22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301
-
SHA512
718656a8263b5c02520a6dec2f36684d2c968f550f54448f995b8cab89e71573248f74051598c10d6b0fa92c5a14b88c11e890883ff89af7a212a4cdbab3f98f
Score
6/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1484 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 26 PID 1492 wrote to memory of 1484 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 26 PID 1492 wrote to memory of 1484 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 26 PID 1492 wrote to memory of 1484 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 26 PID 1484 wrote to memory of 1812 1484 cmd.exe 28 PID 1484 wrote to memory of 1812 1484 cmd.exe 28 PID 1484 wrote to memory of 1812 1484 cmd.exe 28 PID 1484 wrote to memory of 1812 1484 cmd.exe 28 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1812 schtasks.exe -
Modifies service 2 TTPs 30 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\BITS\Performance\1008 = "132387668670016000" 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1022 = "132387668671420000" 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\rdyboost\Performance\1023 = "132387668682340000" 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "2" 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe 1492 22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe"C:\Users\Admin\AppData\Local\Temp\22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe"1⤵
- Suspicious use of WriteProcessMemory
- Modifies service
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1492 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"'3⤵
- Creates scheduled task(s)
PID:1812
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1916