Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 02:20
Static task
static1
Behavioral task
behavioral1
Sample
cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe
Resource
win10v2004-20220812-en
General
-
Target
cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe
-
Size
148KB
-
MD5
475f7bfbdd649d939feb3982688e214f
-
SHA1
0a317fd6571db6e7770cf4084cdb3050f036e625
-
SHA256
cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419
-
SHA512
b2d9cca9c916bd556a3b1241aa09ae1ec3ca5000d7307d9d6946fb8243f76737e07f86011edb0e9bb0229445771fb2313b64b7a543c4d7950aa8ec0c665a1331
-
SSDEEP
1536:YvtawKCWgxdXv82Oj+P2YegT/CjgmeJs2wAj:Yv+Iv8tjkLegT/8gmeTj
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\pcidump.sys cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe File opened for modification C:\Windows\system32\drivers\etc\hosts cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe File opened for modification C:\autorun.inf cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\func.dll cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\phpq.dll cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1816 sc.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1172 ipconfig.exe -
Kills process with taskkill 3 IoCs
pid Process 2040 taskkill.exe 884 taskkill.exe 1812 taskkill.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 460 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2040 taskkill.exe Token: SeDebugPrivilege 884 taskkill.exe Token: SeDebugPrivilege 1812 taskkill.exe -
Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 1048 wrote to memory of 1928 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 27 PID 1048 wrote to memory of 1928 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 27 PID 1048 wrote to memory of 1928 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 27 PID 1048 wrote to memory of 1928 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 27 PID 1048 wrote to memory of 2016 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 30 PID 1048 wrote to memory of 2016 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 30 PID 1048 wrote to memory of 2016 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 30 PID 1048 wrote to memory of 2016 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 30 PID 1048 wrote to memory of 2008 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 28 PID 1048 wrote to memory of 2008 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 28 PID 1048 wrote to memory of 2008 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 28 PID 1048 wrote to memory of 2008 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 28 PID 1048 wrote to memory of 1372 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 32 PID 1048 wrote to memory of 1372 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 32 PID 1048 wrote to memory of 1372 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 32 PID 1048 wrote to memory of 1372 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 32 PID 1048 wrote to memory of 2020 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 34 PID 1048 wrote to memory of 2020 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 34 PID 1048 wrote to memory of 2020 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 34 PID 1048 wrote to memory of 2020 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 34 PID 1048 wrote to memory of 1132 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 35 PID 1048 wrote to memory of 1132 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 35 PID 1048 wrote to memory of 1132 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 35 PID 1048 wrote to memory of 1132 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 35 PID 1928 wrote to memory of 1724 1928 cmd.exe 39 PID 2016 wrote to memory of 1728 2016 cmd.exe 38 PID 1928 wrote to memory of 1724 1928 cmd.exe 39 PID 1928 wrote to memory of 1724 1928 cmd.exe 39 PID 1928 wrote to memory of 1724 1928 cmd.exe 39 PID 2016 wrote to memory of 1728 2016 cmd.exe 38 PID 2016 wrote to memory of 1728 2016 cmd.exe 38 PID 2016 wrote to memory of 1728 2016 cmd.exe 38 PID 2020 wrote to memory of 884 2020 cmd.exe 43 PID 2020 wrote to memory of 884 2020 cmd.exe 43 PID 2020 wrote to memory of 884 2020 cmd.exe 43 PID 2020 wrote to memory of 884 2020 cmd.exe 43 PID 2008 wrote to memory of 1816 2008 cmd.exe 41 PID 2008 wrote to memory of 1816 2008 cmd.exe 41 PID 2008 wrote to memory of 1816 2008 cmd.exe 41 PID 2008 wrote to memory of 1816 2008 cmd.exe 41 PID 1372 wrote to memory of 2040 1372 cmd.exe 42 PID 1372 wrote to memory of 2040 1372 cmd.exe 42 PID 1372 wrote to memory of 2040 1372 cmd.exe 42 PID 1372 wrote to memory of 2040 1372 cmd.exe 42 PID 1132 wrote to memory of 1812 1132 cmd.exe 44 PID 1132 wrote to memory of 1812 1132 cmd.exe 44 PID 1132 wrote to memory of 1812 1132 cmd.exe 44 PID 1132 wrote to memory of 1812 1132 cmd.exe 44 PID 1048 wrote to memory of 2004 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 46 PID 1048 wrote to memory of 2004 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 46 PID 1048 wrote to memory of 2004 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 46 PID 1048 wrote to memory of 2004 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 46 PID 1048 wrote to memory of 2004 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 46 PID 1048 wrote to memory of 2004 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 46 PID 1048 wrote to memory of 2004 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 46 PID 1048 wrote to memory of 1172 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 47 PID 1048 wrote to memory of 1172 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 47 PID 1048 wrote to memory of 1172 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 47 PID 1048 wrote to memory of 1172 1048 cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe"C:\Users\Admin\AppData\Local\Temp\cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe"1⤵
- Drops file in Drivers directory
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.execmd /c cacls C:\Windows /e /p everyone:f2⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cacls.execacls C:\Windows /e /p everyone:f3⤵PID:1724
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config ekrn start= disabled2⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\sc.exesc config ekrn start= disabled3⤵
- Launches sc.exe
PID:1816
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c cacls "C:\Users\Admin\AppData\Local\Temp\" /e /p everyone:f2⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cacls.execacls "C:\Users\Admin\AppData\Local\Temp\" /e /p everyone:f3⤵PID:1728
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /im ekrn.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im ekrn.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /im egui.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im egui.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:884
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /im ScanFrm.exe /f2⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im ScanFrm.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe func.dll, droqp2⤵PID:2004
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all2⤵
- Gathers network information
PID:1172
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5f384de596b479af7460d2c683928bdb5
SHA1bd51d3f1fa4d7b7bf6d3b26d5170e2356e9e01f5
SHA2565a8e8691be891df1fa4ed90103f6f46e306c3349d3ad00b436ecd26de964d635
SHA5121eb57475029ec482c33dae53f266dd6ab1b6b9d51628b7760218ce51faaba5f4a381769e1e5306a5aeadfa67d3b89e73f9b822bfbe1dd66441a8e6ff816c2809