Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe
Resource
win10v2004-20220901-en
General
-
Target
32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe
-
Size
31KB
-
MD5
1d1f570f8864f03e9b204123262fc88f
-
SHA1
0474413b0c075c6c36c5def91234d13b8c4167d2
-
SHA256
32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2
-
SHA512
dfa3e266822115fc324f2e0750199f8516cf9d8a43a45c2f582ca54ad0dd3c21f58cb8b3516aee189703d506854eb9b521c1371eaf32f60d91cbcc7a90078b86
-
SSDEEP
768:oIqeh0FpzQkr4CdjQ1N3LhGjD2/HH0Fiex:oz3FpzR6rbhGaH+F
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0" vvpvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0" svchost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vvpvs.exe -
Executes dropped EXE 1 IoCs
pid Process 1232 vvpvs.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Avt-Net\Parameters\ServiceDll = "%SystemRoot%\\system32\\svcnet32.dll" vvpvs.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Avt-Net\ImagePath = "%SystemRoot%\\system32\\svchost -k Avt-Net" vvpvs.exe -
Deletes itself 1 IoCs
pid Process 1492 cmd.exe -
Loads dropped DLL 3 IoCs
pid Process 852 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe 852 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe 1020 svchost.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\svcnet32.dll vvpvs.exe File opened for modification C:\Windows\SysWOW64\svcnet32.dll vvpvs.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\vvpvs.exe 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe File opened for modification C:\Program Files (x86)\vvpvs.exe 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe File opened for modification C:\Program Files (x86)\syslass.cpl vvpvs.exe File created C:\Program Files (x86)\syslass.cpl vvpvs.exe File opened for modification C:\Program Files (x86)\vvpvs.exe vvpvs.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\WpadDecision = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\WpadDecisionTime = 0018662c72ccd801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1\WpadDecisionTime = 0018662c72ccd801 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE} svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\WpadNetworkName = "Network 2" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\66-33-80-44-1a-b1 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1\WpadDecisionReason = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1\WpadDecision = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe -
Modifies registry class 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0" vvpvs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0" svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 852 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1020 svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 852 wrote to memory of 1232 852 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe 27 PID 852 wrote to memory of 1232 852 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe 27 PID 852 wrote to memory of 1232 852 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe 27 PID 852 wrote to memory of 1232 852 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe 27 PID 852 wrote to memory of 1492 852 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe 29 PID 852 wrote to memory of 1492 852 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe 29 PID 852 wrote to memory of 1492 852 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe 29 PID 852 wrote to memory of 1492 852 32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe"C:\Users\Admin\AppData\Local\Temp\32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Program Files (x86)\vvpvs.exe"C:\Program Files (x86)\vvpvs.exe"2⤵
- Modifies system executable filetype association
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Sets DLL path for service in the registry
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1232
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\32EE8D~1.EXE > nul2⤵
- Deletes itself
PID:1492
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost -k Avt-Net1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD51d1f570f8864f03e9b204123262fc88f
SHA10474413b0c075c6c36c5def91234d13b8c4167d2
SHA25632ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2
SHA512dfa3e266822115fc324f2e0750199f8516cf9d8a43a45c2f582ca54ad0dd3c21f58cb8b3516aee189703d506854eb9b521c1371eaf32f60d91cbcc7a90078b86
-
Filesize
31KB
MD51d1f570f8864f03e9b204123262fc88f
SHA10474413b0c075c6c36c5def91234d13b8c4167d2
SHA25632ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2
SHA512dfa3e266822115fc324f2e0750199f8516cf9d8a43a45c2f582ca54ad0dd3c21f58cb8b3516aee189703d506854eb9b521c1371eaf32f60d91cbcc7a90078b86
-
Filesize
14KB
MD57b56a5a2da99cda4c457913c0aa91fd2
SHA1fa2b7ef4e22274d122b7127bd3bf15b401455372
SHA256204c473348b18c83e86d2ad78675087242d852e7d3b6e9212fb289cb5b2c3eea
SHA5122885fbd377cc8e278130b79498dbfa4fa6040a4f6b6c59f0b07362b31742e3a2ce06ccca8ba05b93f38b02df6ab8ea9d7014ca3275de1311ad610adec4b75d07
-
Filesize
31KB
MD51d1f570f8864f03e9b204123262fc88f
SHA10474413b0c075c6c36c5def91234d13b8c4167d2
SHA25632ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2
SHA512dfa3e266822115fc324f2e0750199f8516cf9d8a43a45c2f582ca54ad0dd3c21f58cb8b3516aee189703d506854eb9b521c1371eaf32f60d91cbcc7a90078b86
-
Filesize
31KB
MD51d1f570f8864f03e9b204123262fc88f
SHA10474413b0c075c6c36c5def91234d13b8c4167d2
SHA25632ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2
SHA512dfa3e266822115fc324f2e0750199f8516cf9d8a43a45c2f582ca54ad0dd3c21f58cb8b3516aee189703d506854eb9b521c1371eaf32f60d91cbcc7a90078b86
-
Filesize
14KB
MD57b56a5a2da99cda4c457913c0aa91fd2
SHA1fa2b7ef4e22274d122b7127bd3bf15b401455372
SHA256204c473348b18c83e86d2ad78675087242d852e7d3b6e9212fb289cb5b2c3eea
SHA5122885fbd377cc8e278130b79498dbfa4fa6040a4f6b6c59f0b07362b31742e3a2ce06ccca8ba05b93f38b02df6ab8ea9d7014ca3275de1311ad610adec4b75d07