Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
23/05/2022, 21:12
Static task
static1
Behavioral task
behavioral1
Sample
0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe
Resource
win10v2004-20220414-en
General
-
Target
0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe
-
Size
16KB
-
MD5
df43659131a6e537daa70ee649309f1f
-
SHA1
c400b4a4678338a9a309dcf13d5e9a36bb2e4f4a
-
SHA256
0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9
-
SHA512
de3a0994ce02ace7b39ff2b2625f2330813c3e1854adbe9e238823e306ae4667f0a3b7b2fa1a7aa499608ce47b14f838b9ddc6d0c7e9c43e5f9fdb9889cd5052
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
resource yara_rule behavioral1/memory/1700-54-0x0000000000ED0000-0x0000000000EDA000-memory.dmp loaderbot -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe" 0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2020 schtasks.exe 2036 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1700 0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1700 0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1700 0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1672 1700 0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe 28 PID 1700 wrote to memory of 1672 1700 0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe 28 PID 1700 wrote to memory of 1672 1700 0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe 28 PID 1700 wrote to memory of 1672 1700 0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe 28 PID 1672 wrote to memory of 2036 1672 cmd.exe 30 PID 1672 wrote to memory of 2036 1672 cmd.exe 30 PID 1672 wrote to memory of 2036 1672 cmd.exe 30 PID 1672 wrote to memory of 2036 1672 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe"C:\Users\Admin\AppData\Local\Temp\0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
PID:2036
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {1D466A3A-C331-4E44-B47E-0582786852F4} S-1-5-21-2277218442-1199762539-2004043321-1000:AUVQQRRF\Admin:Interactive:[1]1⤵PID:1232
-
C:\Users\Admin\AppData\Roaming\Windows\0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exeC:\Users\Admin\AppData\Roaming\Windows\0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe2⤵PID:1320
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f1⤵
- Creates scheduled task(s)
PID:2020
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\0136e18e79051d6549520cb9aa2c1377d12872bed7622b4534e806452d2027d9.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f1⤵PID:832