Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
122s -
platform
windows7_x64 -
resource
win7 -
submitted
13/07/2020, 13:32
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER APPROVED_PDF.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
NEW ORDER APPROVED_PDF.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
NEW ORDER APPROVED_PDF.exe
-
Size
368KB
-
MD5
c3782f33095e240a6c570b8d1265eaa4
-
SHA1
e40c6809253127c918848e2db3173205c12d3def
-
SHA256
6023812166224ffe7f3ff3efacddccd27c4ae1f09aa2dc9e2f5c8557d6bb4382
-
SHA512
9138e8059fe1b00d9a6522b984a5134a39508a45f2d4b4bfb89c9843cc8ca161f2960ab2aa4fee25c8cc8fc6398b9d00beddccf126432233d75fd40792681677
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe 736 NEW ORDER APPROVED_PDF.exe 736 NEW ORDER APPROVED_PDF.exe 736 NEW ORDER APPROVED_PDF.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe 1028 raserver.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1492 wrote to memory of 788 1492 NEW ORDER APPROVED_PDF.exe 24 PID 1492 wrote to memory of 788 1492 NEW ORDER APPROVED_PDF.exe 24 PID 1492 wrote to memory of 788 1492 NEW ORDER APPROVED_PDF.exe 24 PID 1492 wrote to memory of 788 1492 NEW ORDER APPROVED_PDF.exe 24 PID 1492 wrote to memory of 736 1492 NEW ORDER APPROVED_PDF.exe 25 PID 1492 wrote to memory of 736 1492 NEW ORDER APPROVED_PDF.exe 25 PID 1492 wrote to memory of 736 1492 NEW ORDER APPROVED_PDF.exe 25 PID 1492 wrote to memory of 736 1492 NEW ORDER APPROVED_PDF.exe 25 PID 1492 wrote to memory of 736 1492 NEW ORDER APPROVED_PDF.exe 25 PID 1492 wrote to memory of 736 1492 NEW ORDER APPROVED_PDF.exe 25 PID 1492 wrote to memory of 736 1492 NEW ORDER APPROVED_PDF.exe 25 PID 1228 wrote to memory of 1028 1228 Explorer.EXE 26 PID 1228 wrote to memory of 1028 1228 Explorer.EXE 26 PID 1228 wrote to memory of 1028 1228 Explorer.EXE 26 PID 1228 wrote to memory of 1028 1228 Explorer.EXE 26 PID 1028 wrote to memory of 1520 1028 raserver.exe 27 PID 1028 wrote to memory of 1520 1028 raserver.exe 27 PID 1028 wrote to memory of 1520 1028 raserver.exe 27 PID 1028 wrote to memory of 1520 1028 raserver.exe 27 -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1492 set thread context of 736 1492 NEW ORDER APPROVED_PDF.exe 25 PID 736 set thread context of 1228 736 NEW ORDER APPROVED_PDF.exe 20 PID 736 set thread context of 1228 736 NEW ORDER APPROVED_PDF.exe 20 PID 1028 set thread context of 1228 1028 raserver.exe 20 -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1492 NEW ORDER APPROVED_PDF.exe Token: SeDebugPrivilege 736 NEW ORDER APPROVED_PDF.exe Token: SeDebugPrivilege 1028 raserver.exe -
Loads dropped DLL 2 IoCs
pid Process 1492 NEW ORDER APPROVED_PDF.exe 1492 NEW ORDER APPROVED_PDF.exe -
Executes dropped EXE 2 IoCs
pid Process 788 NEW ORDER APPROVED_PDF.exe 736 NEW ORDER APPROVED_PDF.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 736 NEW ORDER APPROVED_PDF.exe 736 NEW ORDER APPROVED_PDF.exe 736 NEW ORDER APPROVED_PDF.exe 736 NEW ORDER APPROVED_PDF.exe 1028 raserver.exe 1028 raserver.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"3⤵
- Executes dropped EXE
PID:788
-
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:736
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1028 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"3⤵PID:1520
-
-