Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 05:08
Behavioral task
behavioral1
Sample
f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
General
-
Target
f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe
-
Size
297KB
-
MD5
67d57e6532486d3860ae7f0f161165d3
-
SHA1
14e77f816e387fa2c19306f03351fb61600a5314
-
SHA256
f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5
-
SHA512
e48501f60c7dad6fe08ddebd218226db5221bb545bf4ae9c77b3055cd36a4720b1fd8a2fdc5ab79353aef06dfabffcb6cd3e34c440d7f17a4e84c1d8765f2329
-
SSDEEP
6144:vKWEtwzPU2LT3JW/cTXty0U+Et5X3mqBRx4X+ZWri:XHzV/3JWOXc0U+ErnmqBRqX+Zai
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2032-54-0x0000000000400000-0x0000000000475000-memory.dmp upx behavioral1/memory/2032-96-0x0000000000400000-0x0000000000475000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\J: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\X: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\Y: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\F: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\R: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\S: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\T: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\V: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\Z: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\Q: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\U: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\G: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\H: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\I: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\L: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\M: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\P: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\K: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\N: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\O: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened (read-only) \??\W: f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\svchost.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File created \??\c:\windows\SysWOW64\svchost.vir f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File created \??\c:\windows\SysWOW64\msiexec.vir f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File created \??\c:\windows\SysWOW64\searchindexer.vir f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File created \??\c:\windows\SysWOW64\dllhost.vir f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\7-Zip\7z.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File created C:\Program Files\7-Zip\Uninstall.vir f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\windows\servicing\trustedinstaller.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1F7885BE-67EC-45A5-942E-14137F1E46FB}.crmlog dllhost.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{1F7885BE-67EC-45A5-942E-14137F1E46FB}.crmlog dllhost.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\ehome\ehsched.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap SearchIndexer.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2032 f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe Token: SeRestorePrivilege 1080 msiexec.exe Token: SeTakeOwnershipPrivilege 1080 msiexec.exe Token: SeSecurityPrivilege 1080 msiexec.exe Token: SeManageVolumePrivilege 696 SearchIndexer.exe Token: 33 696 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 696 SearchIndexer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 664 SearchProtocolHost.exe 664 SearchProtocolHost.exe 664 SearchProtocolHost.exe 664 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 696 wrote to memory of 664 696 SearchIndexer.exe 30 PID 696 wrote to memory of 664 696 SearchIndexer.exe 30 PID 696 wrote to memory of 664 696 SearchIndexer.exe 30 PID 696 wrote to memory of 1296 696 SearchIndexer.exe 31 PID 696 wrote to memory of 1296 696 SearchIndexer.exe 31 PID 696 wrote to memory of 1296 696 SearchIndexer.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe"C:\Users\Admin\AppData\Local\Temp\f85bd0fdc8d542369ce6b4879f2eb4a6a53339257d17756e8c1331e499e682e5.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
PID:1552
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4063495947-34355257-727531523-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4063495947-34355257-727531523-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:664
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 5202⤵PID:1296
-