Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 00:23
Static task
static1
Behavioral task
behavioral1
Sample
18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe
Resource
win10v2004-20220812-en
General
-
Target
18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe
-
Size
184KB
-
MD5
9255d99c1c4eb4b7b4aabdb4aae1dec6
-
SHA1
8c55e6b16241b7022e8f9dce03482c0c87e9aaf0
-
SHA256
18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612
-
SHA512
8ba91ec692efa2050f376eeec65f38f68e649100001311873f6426908f9892dd1231f98273827f4c677317b12afd3c7f4bd07419ef1b0d2f713ec1011f49c07c
-
SSDEEP
3072:++V2Uz616rBNEbGdtV8P7xWmbsSw1UKqjlU3YZhIrcNCcN5Q4jkXqSbo4nvSMgHt:B2Uz7MEExf+IZ2qLGqSbokvSMgbD0Re
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 332 csrss.exe -
Deletes itself 1 IoCs
pid Process 1976 cmd.exe -
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 94.242.250.64 Destination IP 94.242.250.64 Destination IP 94.242.250.64 Destination IP 94.242.250.64 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 532 set thread context of 1976 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 27 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 332 csrss.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe Token: SeDebugPrivilege 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 332 csrss.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 532 wrote to memory of 1412 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 14 PID 532 wrote to memory of 332 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 6 PID 532 wrote to memory of 1976 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 27 PID 532 wrote to memory of 1976 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 27 PID 532 wrote to memory of 1976 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 27 PID 532 wrote to memory of 1976 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 27 PID 532 wrote to memory of 1976 532 18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe 27 PID 332 wrote to memory of 868 332 csrss.exe 20
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe"C:\Users\Admin\AppData\Local\Temp\18dcaead28247cd23490af8bdef9c48945de43db2b1cbda92ed069d074ce5612.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:1976
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:868
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD56bf2039986af96d98e08824ac6c383fd
SHA10bb6384656a96943cb427baa92446f987219a02e
SHA256a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f
SHA512fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e
-
Filesize
2KB
MD5c5e2dcd9bee4cc6d0f93548c464882b6
SHA103b1bd6756a372bd6903cdfac97d94ee48b91a15
SHA25697977658dfc8aeb594c087d50bd92cfff22dc5511b790df6c48d7693e22d6420
SHA512b4fa67daa77c7dd3d1083d2d9c0cea7a6dadf8eb7b0a508da1ac05104d9bf82dacb5e12e3e5e2cae233db22cafe9e1784f5a62aa4beb9c231f9c9fd2a2758233
-
Filesize
52KB
MD56bf2039986af96d98e08824ac6c383fd
SHA10bb6384656a96943cb427baa92446f987219a02e
SHA256a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f
SHA512fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e