Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
6ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
9ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
7ฺฺฺK...ฺฺ
windows10_x64
ฺฺฺK...ฺฺ
windows10_x64
10Resubmissions
03/07/2024, 22:59
240703-2yn7wszhlp 1003/07/2024, 16:13
240703-tn93lsyglf 1003/07/2024, 16:11
240703-tm84xsyfma 1010/05/2024, 16:25
240510-tw1h5shh47 1024/08/2023, 11:16
230824-nda8msdf8z 10Analysis
-
max time kernel
1130s -
max time network
1138s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
22/11/2020, 06:42
Static task
static1
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral24
Sample
Endermanch@NavaShield(1).exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
Errors
Reason
Machine shutdown
General
-
Target
-
Size
1.2MB
-
MD5
910dd666c83efd3496f21f9f211cdc1f
-
SHA1
77cd736ee1697beda0ac65da24455ec566ba7440
-
SHA256
06effc4c15d371b5c40a84995a7bae75324b690af9fbe2e8980f8c0e0901bf45
-
SHA512
467d3b4d45a41b90c8e29c8c3d46ddfbdee9875606cd1c1b7652c2c7e26d60fedac54b24b75def125d450d8e811c75974260ba48a79496d2bdaf17d674eddb47
Score
10/10
Malware Config
Signatures
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Deletes NTFS Change Journal 2 TTPs
The USN change journal is a persistent log of all changes made to local files used by Windows Server systems.
-
Clears Windows event logs 1 TTPs
-
Blacklisted process makes network request 3 IoCs
flow pid Process 416 1860 rundll32.exe 427 1860 rundll32.exe 439 1860 rundll32.exe -
Executes dropped EXE 2 IoCs
pid Process 3704 avpc2009.exe 2932 F7A5.tmp -
Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs
Enables rebooting of the machine without requiring login credentials.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe -
Loads dropped DLL 3 IoCs
pid Process 3704 avpc2009.exe 3704 avpc2009.exe 3704 avpc2009.exe -
JavaScript code in executable 2 IoCs
resource yara_rule behavioral3/files/0x000100000001ac01-3.dat js behavioral3/files/0x000100000001ac01-4.dat js -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\antiviruspc2009\__tmp_rar_sfx_access_check_259305312 [email protected] File opened for modification C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll [email protected] File opened for modification C:\Program Files (x86)\antiviruspc2009\bzip2.dll [email protected] File opened for modification C:\Program Files (x86)\antiviruspc2009\avpc2009.exe [email protected] File created C:\Program Files (x86)\antiviruspc2009\libltdl3.dll [email protected] File opened for modification C:\Program Files (x86)\antiviruspc2009 [email protected] File created C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll [email protected] File created C:\Program Files (x86)\antiviruspc2009\bzip2.dll [email protected] File created C:\Program Files (x86)\antiviruspc2009\avpc2009.exe [email protected] File opened for modification C:\Program Files (x86)\antiviruspc2009\libltdl3.dll [email protected] -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\infpub.dat rundll32.exe File created C:\Windows\cscc.dat rundll32.exe File created C:\Windows\dispci.exe rundll32.exe File opened for modification C:\Windows\F7A5.tmp rundll32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4068 schtasks.exe 2248 schtasks.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 8 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 10 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 1860 rundll32.exe 2932 F7A5.tmp 2932 F7A5.tmp 2932 F7A5.tmp 2932 F7A5.tmp 2932 F7A5.tmp 2932 F7A5.tmp 1860 rundll32.exe 1860 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 1860 rundll32.exe Token: SeDebugPrivilege 1860 rundll32.exe Token: SeTcbPrivilege 1860 rundll32.exe Token: SeDebugPrivilege 2932 F7A5.tmp Token: SeSecurityPrivilege 4712 wevtutil.exe Token: SeBackupPrivilege 4712 wevtutil.exe Token: SeSecurityPrivilege 4812 wevtutil.exe Token: SeBackupPrivilege 4812 wevtutil.exe Token: SeSecurityPrivilege 4800 wevtutil.exe Token: SeBackupPrivilege 4800 wevtutil.exe Token: SeSecurityPrivilege 1556 wevtutil.exe Token: SeBackupPrivilege 1556 wevtutil.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3704 avpc2009.exe 3704 avpc2009.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3704 avpc2009.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3704 avpc2009.exe 3704 avpc2009.exe 5044 LogonUI.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 4804 wrote to memory of 3704 4804 [email protected] 73 PID 4804 wrote to memory of 3704 4804 [email protected] 73 PID 4804 wrote to memory of 3704 4804 [email protected] 73 PID 1744 wrote to memory of 1860 1744 rundll32.exe 80 PID 1744 wrote to memory of 1860 1744 rundll32.exe 80 PID 1744 wrote to memory of 1860 1744 rundll32.exe 80 PID 1860 wrote to memory of 1760 1860 rundll32.exe 81 PID 1860 wrote to memory of 1760 1860 rundll32.exe 81 PID 1860 wrote to memory of 1760 1860 rundll32.exe 81 PID 1760 wrote to memory of 2312 1760 cmd.exe 83 PID 1760 wrote to memory of 2312 1760 cmd.exe 83 PID 1760 wrote to memory of 2312 1760 cmd.exe 83 PID 1860 wrote to memory of 2524 1860 rundll32.exe 84 PID 1860 wrote to memory of 2524 1860 rundll32.exe 84 PID 1860 wrote to memory of 2524 1860 rundll32.exe 84 PID 1860 wrote to memory of 2564 1860 rundll32.exe 86 PID 1860 wrote to memory of 2564 1860 rundll32.exe 86 PID 1860 wrote to memory of 2564 1860 rundll32.exe 86 PID 1860 wrote to memory of 2932 1860 rundll32.exe 87 PID 1860 wrote to memory of 2932 1860 rundll32.exe 87 PID 2524 wrote to memory of 4068 2524 cmd.exe 90 PID 2524 wrote to memory of 4068 2524 cmd.exe 90 PID 2524 wrote to memory of 4068 2524 cmd.exe 90 PID 2564 wrote to memory of 2248 2564 cmd.exe 91 PID 2564 wrote to memory of 2248 2564 cmd.exe 91 PID 2564 wrote to memory of 2248 2564 cmd.exe 91 PID 1860 wrote to memory of 4004 1860 rundll32.exe 93 PID 1860 wrote to memory of 4004 1860 rundll32.exe 93 PID 1860 wrote to memory of 4004 1860 rundll32.exe 93 PID 4004 wrote to memory of 4712 4004 cmd.exe 95 PID 4004 wrote to memory of 4712 4004 cmd.exe 95 PID 4004 wrote to memory of 4712 4004 cmd.exe 95 PID 4004 wrote to memory of 4812 4004 cmd.exe 96 PID 4004 wrote to memory of 4812 4004 cmd.exe 96 PID 4004 wrote to memory of 4812 4004 cmd.exe 96 PID 4004 wrote to memory of 4800 4004 cmd.exe 97 PID 4004 wrote to memory of 4800 4004 cmd.exe 97 PID 4004 wrote to memory of 4800 4004 cmd.exe 97 PID 4004 wrote to memory of 1556 4004 cmd.exe 98 PID 4004 wrote to memory of 1556 4004 cmd.exe 98 PID 4004 wrote to memory of 1556 4004 cmd.exe 98 PID 4004 wrote to memory of 2132 4004 cmd.exe 99 PID 4004 wrote to memory of 2132 4004 cmd.exe 99 PID 4004 wrote to memory of 2132 4004 cmd.exe 99 PID 1860 wrote to memory of 2196 1860 rundll32.exe 100 PID 1860 wrote to memory of 2196 1860 rundll32.exe 100 PID 1860 wrote to memory of 2196 1860 rundll32.exe 100 PID 2196 wrote to memory of 4080 2196 cmd.exe 103 PID 2196 wrote to memory of 4080 2196 cmd.exe 103 PID 2196 wrote to memory of 4080 2196 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Program Files (x86)\antiviruspc2009\avpc2009.exe"C:\Program Files (x86)\antiviruspc2009\avpc2009.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3704
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\infpub.dat",#2 151⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Blacklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵PID:2312
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3729624301 && exit"3⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 3729624301 && exit"4⤵
- Creates scheduled task(s)
PID:4068
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 07:02:003⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 07:02:004⤵
- Creates scheduled task(s)
PID:2248
-
-
-
C:\Windows\F7A5.tmp"C:\Windows\F7A5.tmp" \\.\pipe\{46897604-B951-499D-AD72-3DB14CAD911C}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
C:\Windows\SysWOW64\cmd.exe/c wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C:3⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Setup4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4712
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl System4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Security4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil cl Application4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
-
C:\Windows\SysWOW64\fsutil.exefsutil usn deletejournal /D C:4⤵PID:2132
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN drogon3⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN drogon4⤵PID:4080
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ad4055 /state1:0x41c64e6d1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5044