Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe
-
Size
31KB
-
MD5
e974382a9c48f021c708e09c73f34dc0
-
SHA1
0b63fc473955b58407191b1d5110b4f85acf839b
-
SHA256
32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119
-
SHA512
f2850c4aa85213ae6205cb8884c554b63b6f7cfdd1c24c680563fac9b62545a92e121319bfee209307aa9a5ed39f69f4dd9326c25aee29c0126354d1950eeba2
-
SSDEEP
768:n0jzwKwkKMtykxLqJgt8tBlnbcuyD7UzNWGj:nlEKZ3G8pnouy85R
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe -
Loads dropped DLL 1 IoCs
pid Process 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\360se = "C:\\Users\\Admin\\AppData\\Local\\Temp\\32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe" 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\n: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\r: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\s: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\w: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\x: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\z: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\e: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\f: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\i: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\p: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\q: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\v: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\j: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\k: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\l: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\m: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\h: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\o: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\t: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\u: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened (read-only) \??\y: 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\7104488.DLL 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\rgdltecq\nhoifz.pif 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe File opened for modification C:\Program Files (x86)\Common Files\rgdltecq\nhoifz.pif 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe Token: SeDebugPrivilege 328 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe"C:\Users\Admin\AppData\Local\Temp\32a0b31d2fa1153a5b397b6d2cb977688da3d85181999de61a9e65f2b7288119.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:328
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.1MB
MD51f680d0ee69427274607f0af803bcd1c
SHA19dfd4eaceefc822de980682883b328c5a3514f23
SHA256ac2193317b18e00cb17f3083ba80a52d7d833fbe2b825fb6afe669c8db0e09d6
SHA512d357683002b9096b356baa60a8f899c64fed1f1d4851701e19f948a2eb1f812291632fd67319f125461fa6313e1af8731f0269737813ab5774c7320a86533595