Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
170s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/10/2022, 19:54
Behavioral task
behavioral1
Sample
accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe
Resource
win10v2004-20220812-en
General
-
Target
accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe
-
Size
1.1MB
-
MD5
4c4a1796e61e532a3a9108c705f5b74e
-
SHA1
2a6bc5c5cdcefac83bd47b58761690bc4dfb4284
-
SHA256
accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d
-
SHA512
024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa
-
SSDEEP
24576:ubq0z+FMnSJU96SyN+rsbvco1Pc9McNC1Dy4D6N+/GtD9M7SW0LvZkDV:ubx8MSJfT+rsbPK93NSDB+N+QO3NDV
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1744 adobereader.exe 268 adobereader.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1652 netsh.exe -
resource yara_rule behavioral1/memory/2016-55-0x0000000000400000-0x00000000007BC000-memory.dmp upx behavioral1/memory/2016-66-0x0000000000400000-0x00000000007BC000-memory.dmp upx behavioral1/files/0x00140000000054ab-69.dat upx behavioral1/files/0x00140000000054ab-71.dat upx behavioral1/memory/1744-74-0x0000000000400000-0x00000000007BC000-memory.dmp upx behavioral1/files/0x00140000000054ab-77.dat upx behavioral1/files/0x00140000000054ab-78.dat upx behavioral1/files/0x00140000000054ab-87.dat upx behavioral1/memory/1744-89-0x0000000000400000-0x00000000007BC000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1696 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 1744 adobereader.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Driver Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\adobereader.exe" accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Driver Update = "C:\\Users\\Admin\\AppData\\Local\\Temp\\adobereader.exe" accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2016 set thread context of 1696 2016 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 27 PID 1744 set thread context of 268 1744 adobereader.exe 30 -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1696 2016 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 27 PID 2016 wrote to memory of 1696 2016 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 27 PID 2016 wrote to memory of 1696 2016 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 27 PID 2016 wrote to memory of 1696 2016 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 27 PID 2016 wrote to memory of 1696 2016 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 27 PID 2016 wrote to memory of 1696 2016 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 27 PID 2016 wrote to memory of 1696 2016 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 27 PID 2016 wrote to memory of 1696 2016 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 27 PID 2016 wrote to memory of 1696 2016 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 27 PID 1696 wrote to memory of 1652 1696 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 28 PID 1696 wrote to memory of 1652 1696 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 28 PID 1696 wrote to memory of 1652 1696 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 28 PID 1696 wrote to memory of 1652 1696 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 28 PID 1696 wrote to memory of 1744 1696 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 29 PID 1696 wrote to memory of 1744 1696 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 29 PID 1696 wrote to memory of 1744 1696 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 29 PID 1696 wrote to memory of 1744 1696 accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe 29 PID 1744 wrote to memory of 268 1744 adobereader.exe 30 PID 1744 wrote to memory of 268 1744 adobereader.exe 30 PID 1744 wrote to memory of 268 1744 adobereader.exe 30 PID 1744 wrote to memory of 268 1744 adobereader.exe 30 PID 1744 wrote to memory of 268 1744 adobereader.exe 30 PID 1744 wrote to memory of 268 1744 adobereader.exe 30 PID 1744 wrote to memory of 268 1744 adobereader.exe 30 PID 1744 wrote to memory of 268 1744 adobereader.exe 30 PID 1744 wrote to memory of 268 1744 adobereader.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe"C:\Users\Admin\AppData\Local\Temp\accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe"C:\Users\Admin\AppData\Local\Temp\accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\adobereader.exe" "Adobe Driver Update" ENABLE3⤵
- Modifies Windows Firewall
PID:1652
-
-
C:\Users\Admin\AppData\Local\Temp\adobereader.exe"C:\Users\Admin\AppData\Local\Temp\adobereader.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\adobereader.exe"C:\Users\Admin\AppData\Local\Temp\adobereader.exe"4⤵
- Executes dropped EXE
PID:268
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD54c4a1796e61e532a3a9108c705f5b74e
SHA12a6bc5c5cdcefac83bd47b58761690bc4dfb4284
SHA256accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d
SHA512024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa
-
Filesize
1.1MB
MD54c4a1796e61e532a3a9108c705f5b74e
SHA12a6bc5c5cdcefac83bd47b58761690bc4dfb4284
SHA256accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d
SHA512024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa
-
Filesize
1.1MB
MD54c4a1796e61e532a3a9108c705f5b74e
SHA12a6bc5c5cdcefac83bd47b58761690bc4dfb4284
SHA256accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d
SHA512024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa
-
Filesize
1.1MB
MD54c4a1796e61e532a3a9108c705f5b74e
SHA12a6bc5c5cdcefac83bd47b58761690bc4dfb4284
SHA256accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d
SHA512024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa
-
Filesize
1.1MB
MD54c4a1796e61e532a3a9108c705f5b74e
SHA12a6bc5c5cdcefac83bd47b58761690bc4dfb4284
SHA256accd6b29097b0d9f3df050ebe9f85443dff541391b24381c4c39a4fc8727120d
SHA512024baf100e11ea53af0bf3dec768ced839c1ba9a23c0f66aa0f3c336be63e90c7e8cb4c19a12b4d9381fe971ea886fb1f69ea8ec8d369c2521a779c3b80b93fa