Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 02:52
Static task
static1
Behavioral task
behavioral1
Sample
77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe
-
Size
191KB
-
MD5
9db15662892c1aaf71fc639c7310282b
-
SHA1
b444662434f8debacc9a5b2ff7f05d1247823391
-
SHA256
77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560
-
SHA512
02d748fd68122d393f2fa53a3f5073e50cd2d207b78bd3e18e5337b38f7b3acca0d9b73660c935dec4326eeecefc946dc27c9006ca372504910fe9a4de759cb9
-
SSDEEP
3072:/mEcppEjCTfaAIWSqTlrbPLEF7vmsZxE7hbNbLxX2t1v5IH97UoHop:/mEczfa4NlHTK7xxEFBHxmHRIH+ka
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\twext.exe," 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\twext.exe 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe File created C:\Windows\SysWOW64\twext.exe 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2464 set thread context of 3804 2464 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 84 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2464 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2464 wrote to memory of 3804 2464 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 84 PID 2464 wrote to memory of 3804 2464 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 84 PID 2464 wrote to memory of 3804 2464 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 84 PID 2464 wrote to memory of 3804 2464 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 84 PID 2464 wrote to memory of 3804 2464 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 84 PID 2464 wrote to memory of 3804 2464 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 84 PID 2464 wrote to memory of 3804 2464 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 84 PID 2464 wrote to memory of 3804 2464 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 84 PID 2464 wrote to memory of 3804 2464 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 84 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6 PID 3804 wrote to memory of 620 3804 77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe 6
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe"C:\Users\Admin\AppData\Local\Temp\77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe"C:\Users\Admin\AppData\Local\Temp\77e8c924b6917a0ea57316baa27e2b54a7d75a5fa5e480c432b1892a4805e560.exe"2⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804
-