Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

22f372a62b...01.exe

windows7_x64

6

22f372a62b...01.exe

windows10_x64

6

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    09/07/2020, 11:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe

  • Size

    193KB

  • MD5

    5cfacc34c063d14b2a10e99b1512c532

  • SHA1

    b505a5c20a3aa8ed1ceba82442787fa44f4caf1a

  • SHA256

    22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301

  • SHA512

    718656a8263b5c02520a6dec2f36684d2c968f550f54448f995b8cab89e71573248f74051598c10d6b0fa92c5a14b88c11e890883ff89af7a212a4cdbab3f98f

Score
6/10
persistence

Malware Config

Signatures

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies service 2 TTPs 27 IoCs
    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe
    "C:\Users\Admin\AppData\Local\Temp\22f372a62b10bd40e04174512b0251bb0a2f49d243cb45dad8c91c21557ed301.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Modifies service
    PID:896
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:2792
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:3584

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/896-2-0x00000000075B0000-0x00000000075B1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/896-3-0x00000000075B0000-0x00000000075B1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/896-4-0x00000000075B0000-0x00000000075B1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/896-5-0x00000000075B0000-0x00000000075B1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/896-6-0x00000000076B0000-0x00000000076B1000-memory.dmp

      Filesize

      4KB

      Download