Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 06:26
Static task
static1
Behavioral task
behavioral1
Sample
4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe
Resource
win7-20220901-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe
-
Size
316KB
-
MD5
57a8ba5e980c285cc124f766aab57a90
-
SHA1
a2de9ff2121b705cf471a0eb88f379ea22ee0fae
-
SHA256
4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd
-
SHA512
9562c65d46c9cfac30734ed4ff65a9c94769967a90fb02ec3a3bea520c77afd2a7571836bfe27cedf6d92c50ab448231592fb48e1c032ba799482ed557997265
-
SSDEEP
6144:RHjwI7Ro8vT91lV7bjFZaChLXMe65ytmZLL0MdWnpQZh9h4/:ZjwARb91lVTFRjaYsuMd0QZh9u/
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\Windupdt\\winupdate.exe" 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" winupdate.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Executes dropped EXE 1 IoCs
pid Process 4828 winupdate.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\Windupdt\\winupdate.exe" 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run winupdate.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Windupdt\winupdate.exe 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe File opened for modification C:\Windows\Windupdt\ 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe File created C:\Windows\Windupdt\winupdate.exe 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2192 ping.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4828 winupdate.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeSecurityPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeTakeOwnershipPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeLoadDriverPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeSystemProfilePrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeSystemtimePrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeProfSingleProcessPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeIncBasePriorityPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeCreatePagefilePrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeBackupPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeRestorePrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeShutdownPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeDebugPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeSystemEnvironmentPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeChangeNotifyPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeRemoteShutdownPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeUndockPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeManageVolumePrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeImpersonatePrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeCreateGlobalPrivilege 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: 33 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: 34 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: 35 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: 36 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe Token: SeIncreaseQuotaPrivilege 4828 winupdate.exe Token: SeSecurityPrivilege 4828 winupdate.exe Token: SeTakeOwnershipPrivilege 4828 winupdate.exe Token: SeLoadDriverPrivilege 4828 winupdate.exe Token: SeSystemProfilePrivilege 4828 winupdate.exe Token: SeSystemtimePrivilege 4828 winupdate.exe Token: SeProfSingleProcessPrivilege 4828 winupdate.exe Token: SeIncBasePriorityPrivilege 4828 winupdate.exe Token: SeCreatePagefilePrivilege 4828 winupdate.exe Token: SeBackupPrivilege 4828 winupdate.exe Token: SeRestorePrivilege 4828 winupdate.exe Token: SeShutdownPrivilege 4828 winupdate.exe Token: SeDebugPrivilege 4828 winupdate.exe Token: SeSystemEnvironmentPrivilege 4828 winupdate.exe Token: SeChangeNotifyPrivilege 4828 winupdate.exe Token: SeRemoteShutdownPrivilege 4828 winupdate.exe Token: SeUndockPrivilege 4828 winupdate.exe Token: SeManageVolumePrivilege 4828 winupdate.exe Token: SeImpersonatePrivilege 4828 winupdate.exe Token: SeCreateGlobalPrivilege 4828 winupdate.exe Token: 33 4828 winupdate.exe Token: 34 4828 winupdate.exe Token: 35 4828 winupdate.exe Token: 36 4828 winupdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4828 winupdate.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4260 wrote to memory of 2624 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe 80 PID 4260 wrote to memory of 2624 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe 80 PID 4260 wrote to memory of 2624 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe 80 PID 4260 wrote to memory of 4828 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe 81 PID 4260 wrote to memory of 4828 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe 81 PID 4260 wrote to memory of 4828 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe 81 PID 4828 wrote to memory of 1212 4828 winupdate.exe 82 PID 4828 wrote to memory of 1212 4828 winupdate.exe 82 PID 4828 wrote to memory of 1212 4828 winupdate.exe 82 PID 4260 wrote to memory of 2192 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe 83 PID 4260 wrote to memory of 2192 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe 83 PID 4260 wrote to memory of 2192 4260 4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe"C:\Users\Admin\AppData\Local\Temp\4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵PID:2624
-
-
C:\Windows\Windupdt\winupdate.exe"C:\Windows\Windupdt\winupdate.exe"2⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Checks BIOS information in registry
- Windows security modification
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵PID:1212
-
-
-
C:\Windows\SysWOW64\ping.exeping 127.0.0.1 -n 5 > NUL del "C:\Users\Admin\AppData\Local\Temp\4f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd.exe"2⤵
- Runs ping.exe
PID:2192
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
316KB
MD557a8ba5e980c285cc124f766aab57a90
SHA1a2de9ff2121b705cf471a0eb88f379ea22ee0fae
SHA2564f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd
SHA5129562c65d46c9cfac30734ed4ff65a9c94769967a90fb02ec3a3bea520c77afd2a7571836bfe27cedf6d92c50ab448231592fb48e1c032ba799482ed557997265
-
Filesize
316KB
MD557a8ba5e980c285cc124f766aab57a90
SHA1a2de9ff2121b705cf471a0eb88f379ea22ee0fae
SHA2564f14b97c7ab69709f262f8ef0bb4fab6073a05fe28481fb85d1ef698552c41cd
SHA5129562c65d46c9cfac30734ed4ff65a9c94769967a90fb02ec3a3bea520c77afd2a7571836bfe27cedf6d92c50ab448231592fb48e1c032ba799482ed557997265