Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 16:41
Static task
static1
Behavioral task
behavioral1
Sample
8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe
Resource
win10v2004-20220812-en
General
-
Target
8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe
-
Size
123KB
-
MD5
1b15ba50025490779f2eacdef86c42e3
-
SHA1
29cb3899bc2d6bd8ecce5c7a4e9d20c2ce87ee75
-
SHA256
8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a
-
SHA512
c415cc3f28b1e81f761ece4013f10dee430f894c2079dc2aa3649d82c6662844feef6de0c05610695525fd512c5a3c205c17758655219f1687cdd8454b94d36f
-
SSDEEP
1536:gR0vxn3Pc0LCH9MtbvabUDzJYWu3BzTjTTTTTTTTAX6ySeyUbSMA:gR2xn3k0CdM1vabyzJYWqaXDSz
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1272 WaterMark.exe -
resource yara_rule behavioral1/memory/1268-57-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1268-58-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1268-63-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/1272-79-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1272-81-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1272-184-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1268 8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe 1268 8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\WaterMark.exe 8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px731E.tmp 8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe 8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7z.dll svchost.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1272 WaterMark.exe 1272 WaterMark.exe 1272 WaterMark.exe 1272 WaterMark.exe 1272 WaterMark.exe 1272 WaterMark.exe 1272 WaterMark.exe 1272 WaterMark.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe 892 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1272 WaterMark.exe Token: SeDebugPrivilege 892 svchost.exe Token: SeDebugPrivilege 1272 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1268 8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe 1272 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1272 1268 8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe 26 PID 1268 wrote to memory of 1272 1268 8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe 26 PID 1268 wrote to memory of 1272 1268 8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe 26 PID 1268 wrote to memory of 1272 1268 8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe 26 PID 1272 wrote to memory of 780 1272 WaterMark.exe 27 PID 1272 wrote to memory of 780 1272 WaterMark.exe 27 PID 1272 wrote to memory of 780 1272 WaterMark.exe 27 PID 1272 wrote to memory of 780 1272 WaterMark.exe 27 PID 1272 wrote to memory of 780 1272 WaterMark.exe 27 PID 1272 wrote to memory of 780 1272 WaterMark.exe 27 PID 1272 wrote to memory of 780 1272 WaterMark.exe 27 PID 1272 wrote to memory of 780 1272 WaterMark.exe 27 PID 1272 wrote to memory of 780 1272 WaterMark.exe 27 PID 1272 wrote to memory of 780 1272 WaterMark.exe 27 PID 1272 wrote to memory of 892 1272 WaterMark.exe 28 PID 1272 wrote to memory of 892 1272 WaterMark.exe 28 PID 1272 wrote to memory of 892 1272 WaterMark.exe 28 PID 1272 wrote to memory of 892 1272 WaterMark.exe 28 PID 1272 wrote to memory of 892 1272 WaterMark.exe 28 PID 1272 wrote to memory of 892 1272 WaterMark.exe 28 PID 1272 wrote to memory of 892 1272 WaterMark.exe 28 PID 1272 wrote to memory of 892 1272 WaterMark.exe 28 PID 1272 wrote to memory of 892 1272 WaterMark.exe 28 PID 1272 wrote to memory of 892 1272 WaterMark.exe 28 PID 892 wrote to memory of 260 892 svchost.exe 25 PID 892 wrote to memory of 260 892 svchost.exe 25 PID 892 wrote to memory of 260 892 svchost.exe 25 PID 892 wrote to memory of 260 892 svchost.exe 25 PID 892 wrote to memory of 260 892 svchost.exe 25 PID 892 wrote to memory of 332 892 svchost.exe 24 PID 892 wrote to memory of 332 892 svchost.exe 24 PID 892 wrote to memory of 332 892 svchost.exe 24 PID 892 wrote to memory of 332 892 svchost.exe 24 PID 892 wrote to memory of 332 892 svchost.exe 24 PID 892 wrote to memory of 368 892 svchost.exe 23 PID 892 wrote to memory of 368 892 svchost.exe 23 PID 892 wrote to memory of 368 892 svchost.exe 23 PID 892 wrote to memory of 368 892 svchost.exe 23 PID 892 wrote to memory of 368 892 svchost.exe 23 PID 892 wrote to memory of 376 892 svchost.exe 22 PID 892 wrote to memory of 376 892 svchost.exe 22 PID 892 wrote to memory of 376 892 svchost.exe 22 PID 892 wrote to memory of 376 892 svchost.exe 22 PID 892 wrote to memory of 376 892 svchost.exe 22 PID 892 wrote to memory of 408 892 svchost.exe 21 PID 892 wrote to memory of 408 892 svchost.exe 21 PID 892 wrote to memory of 408 892 svchost.exe 21 PID 892 wrote to memory of 408 892 svchost.exe 21 PID 892 wrote to memory of 408 892 svchost.exe 21 PID 892 wrote to memory of 460 892 svchost.exe 2 PID 892 wrote to memory of 460 892 svchost.exe 2 PID 892 wrote to memory of 460 892 svchost.exe 2 PID 892 wrote to memory of 460 892 svchost.exe 2 PID 892 wrote to memory of 460 892 svchost.exe 2 PID 892 wrote to memory of 476 892 svchost.exe 1 PID 892 wrote to memory of 476 892 svchost.exe 1 PID 892 wrote to memory of 476 892 svchost.exe 1 PID 892 wrote to memory of 476 892 svchost.exe 1 PID 892 wrote to memory of 476 892 svchost.exe 1 PID 892 wrote to memory of 484 892 svchost.exe 20 PID 892 wrote to memory of 484 892 svchost.exe 20 PID 892 wrote to memory of 484 892 svchost.exe 20 PID 892 wrote to memory of 484 892 svchost.exe 20 PID 892 wrote to memory of 484 892 svchost.exe 20
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:460
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:740
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1980
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1972
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1104
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1068
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:288
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:292
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:832
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:792
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:656
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:576
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe"C:\Users\Admin\AppData\Local\Temp\8a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:780
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:484
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:408
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:376
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:368
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:260
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD51b15ba50025490779f2eacdef86c42e3
SHA129cb3899bc2d6bd8ecce5c7a4e9d20c2ce87ee75
SHA2568a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a
SHA512c415cc3f28b1e81f761ece4013f10dee430f894c2079dc2aa3649d82c6662844feef6de0c05610695525fd512c5a3c205c17758655219f1687cdd8454b94d36f
-
Filesize
123KB
MD51b15ba50025490779f2eacdef86c42e3
SHA129cb3899bc2d6bd8ecce5c7a4e9d20c2ce87ee75
SHA2568a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a
SHA512c415cc3f28b1e81f761ece4013f10dee430f894c2079dc2aa3649d82c6662844feef6de0c05610695525fd512c5a3c205c17758655219f1687cdd8454b94d36f
-
Filesize
123KB
MD51b15ba50025490779f2eacdef86c42e3
SHA129cb3899bc2d6bd8ecce5c7a4e9d20c2ce87ee75
SHA2568a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a
SHA512c415cc3f28b1e81f761ece4013f10dee430f894c2079dc2aa3649d82c6662844feef6de0c05610695525fd512c5a3c205c17758655219f1687cdd8454b94d36f
-
Filesize
123KB
MD51b15ba50025490779f2eacdef86c42e3
SHA129cb3899bc2d6bd8ecce5c7a4e9d20c2ce87ee75
SHA2568a571eacabb176621ed91318ea554edda8e405cd8f2ce1833d43850f032e627a
SHA512c415cc3f28b1e81f761ece4013f10dee430f894c2079dc2aa3649d82c6662844feef6de0c05610695525fd512c5a3c205c17758655219f1687cdd8454b94d36f