Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7 -
submitted
10/07/2020, 12:03
Static task
static1
Behavioral task
behavioral1
Sample
5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe
Resource
win7
Behavioral task
behavioral2
Sample
5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe
Resource
win10v200430
General
-
Target
5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe
-
Size
1.0MB
-
MD5
572fea5f025df78f2d316216fbeee52e
-
SHA1
91b2bf44b1f9282c09f07f16631deaa3ad9d956d
-
SHA256
5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367
-
SHA512
eb238272227c5825477ff1e37dc4f7e467665049d4db5649fff59c39d7745e88b06234d6d1218c05c802e33e21577f9d4a533cb9e23ebe6fb09654f97759c187
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1552 1492 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe 24 PID 1492 wrote to memory of 1552 1492 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe 24 PID 1492 wrote to memory of 1552 1492 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe 24 PID 1492 wrote to memory of 1552 1492 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe 24 PID 1552 wrote to memory of 1620 1552 Installers:bin 25 PID 1552 wrote to memory of 1620 1552 Installers:bin 25 PID 1552 wrote to memory of 1620 1552 Installers:bin 25 PID 1552 wrote to memory of 1620 1552 Installers:bin 25 PID 1552 wrote to memory of 1760 1552 Installers:bin 29 PID 1552 wrote to memory of 1760 1552 Installers:bin 29 PID 1552 wrote to memory of 1760 1552 Installers:bin 29 PID 1552 wrote to memory of 1760 1552 Installers:bin 29 PID 1552 wrote to memory of 1880 1552 Installers:bin 31 PID 1552 wrote to memory of 1880 1552 Installers:bin 31 PID 1552 wrote to memory of 1880 1552 Installers:bin 31 PID 1552 wrote to memory of 1880 1552 Installers:bin 31 PID 1900 wrote to memory of 1816 1900 Installers.exe 35 PID 1900 wrote to memory of 1816 1900 Installers.exe 35 PID 1900 wrote to memory of 1816 1900 Installers.exe 35 PID 1900 wrote to memory of 1816 1900 Installers.exe 35 PID 1900 wrote to memory of 1816 1900 Installers.exe 35 PID 1900 wrote to memory of 1816 1900 Installers.exe 35 PID 1900 wrote to memory of 1816 1900 Installers.exe 35 PID 1816 wrote to memory of 1564 1816 cmd.exe 37 PID 1816 wrote to memory of 1564 1816 cmd.exe 37 PID 1816 wrote to memory of 1564 1816 cmd.exe 37 PID 1816 wrote to memory of 1564 1816 cmd.exe 37 PID 1816 wrote to memory of 1564 1816 cmd.exe 37 PID 1816 wrote to memory of 1564 1816 cmd.exe 37 PID 1816 wrote to memory of 1564 1816 cmd.exe 37 PID 1552 wrote to memory of 1580 1552 Installers:bin 38 PID 1552 wrote to memory of 1580 1552 Installers:bin 38 PID 1552 wrote to memory of 1580 1552 Installers:bin 38 PID 1552 wrote to memory of 1580 1552 Installers:bin 38 PID 1492 wrote to memory of 1628 1492 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe 40 PID 1492 wrote to memory of 1628 1492 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe 40 PID 1492 wrote to memory of 1628 1492 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe 40 PID 1492 wrote to memory of 1628 1492 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe 40 PID 1580 wrote to memory of 1992 1580 cmd.exe 42 PID 1580 wrote to memory of 1992 1580 cmd.exe 42 PID 1580 wrote to memory of 1992 1580 cmd.exe 42 PID 1580 wrote to memory of 1992 1580 cmd.exe 42 PID 1628 wrote to memory of 1984 1628 cmd.exe 43 PID 1628 wrote to memory of 1984 1628 cmd.exe 43 PID 1628 wrote to memory of 1984 1628 cmd.exe 43 PID 1628 wrote to memory of 1984 1628 cmd.exe 43 PID 1816 wrote to memory of 1960 1816 cmd.exe 44 PID 1816 wrote to memory of 1960 1816 cmd.exe 44 PID 1816 wrote to memory of 1960 1816 cmd.exe 44 PID 1816 wrote to memory of 1960 1816 cmd.exe 44 PID 1816 wrote to memory of 1960 1816 cmd.exe 44 PID 1816 wrote to memory of 1960 1816 cmd.exe 44 PID 1816 wrote to memory of 1960 1816 cmd.exe 44 PID 1628 wrote to memory of 2044 1628 cmd.exe 45 PID 1628 wrote to memory of 2044 1628 cmd.exe 45 PID 1628 wrote to memory of 2044 1628 cmd.exe 45 PID 1628 wrote to memory of 2044 1628 cmd.exe 45 PID 1580 wrote to memory of 2040 1580 cmd.exe 46 PID 1580 wrote to memory of 2040 1580 cmd.exe 46 PID 1580 wrote to memory of 2040 1580 cmd.exe 46 PID 1580 wrote to memory of 2040 1580 cmd.exe 46 -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1620 vssadmin.exe -
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Possible privilege escalation attempt 2 IoCs
pid Process 1760 takeown.exe 1880 icacls.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
pid Process 1552 Installers:bin 1900 Installers.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 324 vssvc.exe Token: SeRestorePrivilege 324 vssvc.exe Token: SeAuditPrivilege 324 vssvc.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Installers:bin 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Installers.exe Installers:bin File opened for modification C:\Windows\SysWOW64\Installers.exe attrib.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 1760 takeown.exe 1880 icacls.exe -
Deletes itself 1 IoCs
pid Process 1628 cmd.exe -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 1960 attrib.exe 2044 attrib.exe 2040 attrib.exe -
Loads dropped DLL 5 IoCs
pid Process 1492 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe 1492 5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe 1900 Installers.exe 1900 Installers.exe 1900 Installers.exe -
Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5} vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe"C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe"1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Roaming\Installers:binC:\Users\Admin\AppData\Roaming\Installers:bin -r2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Drops file in System32 directory
PID:1552 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:1620
-
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Installers.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1760
-
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Installers.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1880
-
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Installers" & del "C:\Users\Admin\AppData\Roaming\Installers"3⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵PID:1992
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Installers"4⤵
- Views/modifies file attributes
PID:2040
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe" & del "C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe"2⤵
- Suspicious use of WriteProcessMemory
- Deletes itself
PID:1628 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵PID:1984
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\5cd04805f9753ca08b82e88c27bf5426d1d356bb26b281885573051048911367.exe"3⤵
- Views/modifies file attributes
PID:2044
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:324
-
C:\Windows\SysWOW64\Installers.exeC:\Windows\SysWOW64\Installers.exe -s1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Installers.exe" & del "C:\Windows\SysWOW64\Installers.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵PID:1564
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Installers.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:1960
-
-