Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30/05/2022, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe
Resource
win10v2004-20220414-en
General
-
Target
0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe
-
Size
16KB
-
MD5
ab40066603745181e43105bba9878bf0
-
SHA1
7d8c5bae4ac7f5818cbcdae6d061a66aacdf7016
-
SHA256
0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199
-
SHA512
fe770e8ff35ab36d690b1484b776cde561daf23e6f13e0bc1b87634b47bd820c2f7704e085f0d9a092cd027469c63a1e0122307f2b6cebe3bcfb51898d45037a
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
resource yara_rule behavioral1/memory/2020-54-0x00000000000A0000-0x00000000000AA000-memory.dmp loaderbot -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe" 0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 908 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2020 0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2020 0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2020 0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2024 2020 0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe 28 PID 2020 wrote to memory of 2024 2020 0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe 28 PID 2020 wrote to memory of 2024 2020 0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe 28 PID 2020 wrote to memory of 2024 2020 0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe 28 PID 2024 wrote to memory of 908 2024 cmd.exe 30 PID 2024 wrote to memory of 908 2024 cmd.exe 30 PID 2024 wrote to memory of 908 2024 cmd.exe 30 PID 2024 wrote to memory of 908 2024 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe"C:\Users\Admin\AppData\Local\Temp\0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\0944c74f85fbe3aac10f6c7d86bd8feeabfccc75a8f575216e1f507c140e8199.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
PID:908
-
-