Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
27/01/2024, 19:37
240127-yb9zasafd8 1027/01/2024, 19:36
240127-ybp9wsafb7 1001/05/2021, 01:07
210501-shjstql5m2 10Analysis
-
max time kernel
97s -
max time network
96s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
01/05/2021, 01:07
Static task
static1
Behavioral task
behavioral1
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe
-
Size
56KB
-
MD5
84c1567969b86089cc33dccf41562bcd
-
SHA1
53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2
-
SHA256
516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
-
SHA512
72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies data under HKEY_USERS 25 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\32-e2-17-db-d2-77 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = f0ef7896373ed701 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = f0ef7896373ed701 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86\ = "53411c86" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon\ = "C:\\ProgramData\\53411c86.ico" 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1996 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 1996 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 856 vssvc.exe Token: SeRestorePrivilege 856 vssvc.exe Token: SeAuditPrivilege 856 vssvc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1996 1980 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 27 PID 1980 wrote to memory of 1996 1980 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 27 PID 1980 wrote to memory of 1996 1980 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 27 PID 1980 wrote to memory of 1996 1980 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 27 PID 1980 wrote to memory of 1996 1980 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 27 PID 1996 wrote to memory of 1524 1996 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 34 PID 1996 wrote to memory of 1524 1996 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 34 PID 1996 wrote to memory of 1524 1996 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 34 PID 1996 wrote to memory of 1524 1996 516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"1⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exeC:\Users\Admin\AppData\Local\Temp\516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b.exe -work worker0 job0-19963⤵PID:1524
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:856