Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 02:13

General

  • Target

    14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe

  • Size

    2.0MB

  • MD5

    5fb342fdbf39fabbdfe0c56ab4b46ea7

  • SHA1

    8b23f6343442a0e5c23ee81d5351880f04111033

  • SHA256

    14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9

  • SHA512

    71a7c7077e67eb867d576b3481737383a42c4e499d33b4914c459391f4e897e2e95cd868f9484b21526a5f5d80a57553ed7243e1b0b276008c45c8f1bbc8fea6

  • SSDEEP

    49152:1vouOPLi0mkdlj7t8HHZ41RyDdLpUR5TW6OneqYBAf:hEW099BOHe1RCdLS5oeqiAf

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 8 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe
    "C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe"
    1⤵
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe
      2⤵
      • Adds policy Run key to start application
      • Modifies Installed Components in the registry
      • Adds Run key to start application
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:596
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1780
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:1256
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\14f02f318a6a01df82f644dbddf8dbf4d7b666fa9a840d76a828bda0301e60f9.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:2020
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:932
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\upadter.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\upadter.exe:*:Enabled:Windows Messanger" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1848
        • C:\Windows\SysWOW64\reg.exe
          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\upadter.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\upadter.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • Modifies firewall policy service
          • Modifies registry key
          PID:772

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/596-86-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/596-83-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/596-59-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/596-60-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/596-62-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/596-63-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/596-66-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/596-67-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/596-82-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/1204-80-0x0000000000400000-0x00000000007B2000-memory.dmp

    Filesize

    3.7MB

  • memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

    Filesize

    8KB

  • memory/1204-81-0x0000000005F40000-0x00000000062F2000-memory.dmp

    Filesize

    3.7MB

  • memory/1204-55-0x0000000000400000-0x00000000007B2000-memory.dmp

    Filesize

    3.7MB

  • memory/1204-84-0x0000000000400000-0x00000000007B2000-memory.dmp

    Filesize

    3.7MB

  • memory/1204-85-0x0000000000400000-0x00000000007B2000-memory.dmp

    Filesize

    3.7MB

  • memory/1204-56-0x00000000021C0000-0x000000000233D000-memory.dmp

    Filesize

    1.5MB