Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
21/07/2022, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe
Resource
win7-20220718-en
General
-
Target
18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe
-
Size
4.7MB
-
MD5
fc133ce298306a3e8c6443b64d1bf303
-
SHA1
774ee564f6ae6ce7d0f75e5062b2fa88b00df5da
-
SHA256
18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a
-
SHA512
7c4689555eefef79a67b8dd950104755df63f17b50112b266306bafcabdf4e81d5403b61e8074decae9dfbdd1b4ce1d48fefabc8aa1e6f224f2b1c86e070a917
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\aBOBGSnm.exe" 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Windows\\system32\\aBOBGSnm.exe" reg.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\aBOBGSnm.exe 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe File opened for modification C:\Windows\SysWOW64\aBOBGSnm.exe 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe -
Suspicious use of SetThreadContext 12 IoCs
description pid Process procid_target PID 1500 set thread context of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 set thread context of 1924 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 32 PID 1500 set thread context of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 set thread context of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 set thread context of 1716 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 37 PID 1500 set thread context of 852 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 38 PID 1500 set thread context of 1632 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 39 PID 1500 set thread context of 2044 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 40 PID 1500 set thread context of 2020 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 41 PID 1500 set thread context of 1020 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 42 PID 1500 set thread context of 1112 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 43 PID 1500 set thread context of 1492 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 44 -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1500 wrote to memory of 540 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 27 PID 1500 wrote to memory of 540 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 27 PID 1500 wrote to memory of 540 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 27 PID 1500 wrote to memory of 540 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 27 PID 540 wrote to memory of 932 540 csc.exe 29 PID 540 wrote to memory of 932 540 csc.exe 29 PID 540 wrote to memory of 932 540 csc.exe 29 PID 540 wrote to memory of 932 540 csc.exe 29 PID 1500 wrote to memory of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 wrote to memory of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 wrote to memory of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 wrote to memory of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 wrote to memory of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 wrote to memory of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 wrote to memory of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 wrote to memory of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 wrote to memory of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 wrote to memory of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 wrote to memory of 1124 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 30 PID 1500 wrote to memory of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 wrote to memory of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 wrote to memory of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 wrote to memory of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 wrote to memory of 1924 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 32 PID 1500 wrote to memory of 1924 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 32 PID 1500 wrote to memory of 1924 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 32 PID 1500 wrote to memory of 1924 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 32 PID 1500 wrote to memory of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 wrote to memory of 1924 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 32 PID 1500 wrote to memory of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 wrote to memory of 1924 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 32 PID 1500 wrote to memory of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 wrote to memory of 1924 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 32 PID 1500 wrote to memory of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 wrote to memory of 1924 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 32 PID 1500 wrote to memory of 1924 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 32 PID 1500 wrote to memory of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 wrote to memory of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 wrote to memory of 1520 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 31 PID 1500 wrote to memory of 1388 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 33 PID 1500 wrote to memory of 1388 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 33 PID 1500 wrote to memory of 1388 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 33 PID 1500 wrote to memory of 1388 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 33 PID 1388 wrote to memory of 1112 1388 cmd.exe 35 PID 1388 wrote to memory of 1112 1388 cmd.exe 35 PID 1388 wrote to memory of 1112 1388 cmd.exe 35 PID 1388 wrote to memory of 1112 1388 cmd.exe 35 PID 1500 wrote to memory of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 wrote to memory of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 wrote to memory of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 wrote to memory of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 wrote to memory of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 wrote to memory of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 wrote to memory of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 wrote to memory of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 wrote to memory of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 wrote to memory of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 wrote to memory of 460 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 36 PID 1500 wrote to memory of 1716 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 37 PID 1500 wrote to memory of 1716 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 37 PID 1500 wrote to memory of 1716 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 37 PID 1500 wrote to memory of 1716 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 37 PID 1500 wrote to memory of 1716 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 37 PID 1500 wrote to memory of 1716 1500 18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_fchey4s.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES502.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4D2.tmp"3⤵PID:932
-
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:1124
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:1520
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:1924
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "explorer" /t REG_SZ /d "C:\Windows\system32\aBOBGSnm.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "explorer" /t REG_SZ /d "C:\Windows\system32\aBOBGSnm.exe3⤵
- Adds Run key to start application
PID:1112
-
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:460
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:1716
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:852
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:1632
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:2044
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:1020
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:1112
-
-
C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"C:\Users\Admin\AppData\Local\Temp\18a0c8d80b21635c34073b6bfc676f999739c5c65ec35b53612b737f1ce9182a.exe"2⤵PID:1492
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a6a35ee9f256c6644e301cde3dcfff04
SHA15b8c747f7fc3c7e8b88418b24b0cbc5dbd9a4e54
SHA256b1efe094f6558fbd1eb9b4fdb27be79371b2a4f2a6e3db6a6727a7af1e91c3b7
SHA512fbed63b49205939790a3caa38a186edd0de226bb1e279c9f9fce08a7e21ea693539427704bf6d73452b7ccd86d3a9a5b301db7a1cdcc661e7bf915a09384fc29
-
Filesize
9.3MB
MD5aec3e8f700c7a5583e60efdbd7c1fb6b
SHA136f9993eb4d6a8c9c06783bdc896a3e57fc3bb20
SHA256498d705df12067c988be9a8977051895d1660dec065dc221846f9b4a864a82ae
SHA5120b9f3306dc0b17c0a2a263732aabe6e3202c71f22c9e7d681f7a4dc05b7afcb38c113835e878fac5cad0c917801b6bbfed1f0ee33c5dc0f18055f18baaee93df
-
Filesize
652B
MD518729a74427672a982e9d25abdb3a30c
SHA1fe533a82e350d7b9f8629b5e9886cbfa3800933a
SHA25613e464a7c0053be11b43c03755fbfad32df526cae7d1fa0a7a2740d7796b744b
SHA512261fea9a3e13b4dad51def8146a8c600d04b1afcccda0ce31f683841d5b340801106052aebe75a09fd0bb780c19954e16fe2ad1a793e491496db09c4d1e24a5b
-
Filesize
194B
MD5dd1b7c4c05a47855d82b3ecd3e16e514
SHA17d3ad5b48ea3e0778a165024a1ce20eb66bfc739
SHA25687d059323079feaf3324900d8cd8a485d8af5f961ea6b5e40aae576237c657cd
SHA5128db6b4815361e200a4178f55d9c6cbd27c459ce8fbe45355e3f478215d84a5fbd91839aae9a63eca106bd01706695275b603a0d160a0bba104fafc6879c5822e
-
Filesize
4.7MB
MD551ebb7a4e323a95de7274867baa9f29d
SHA1e8020abf1e404020cfa2a2079c47d24d4e4f48be
SHA25624ef1ca05d32b4253a07e0857e9cd81915e4dccab0b7e7f6cce000e88417c34a
SHA5126a0b4fc6f4c0db58a314403115f7e079882fb2d20ac35699fd32679471608def8f71268286c739923afb782264f1748df6e85c1a1a12c4686d275f11ceebd1dc