Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 15:03
Static task
static1
Behavioral task
behavioral1
Sample
819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe
Resource
win10v2004-20220812-en
General
-
Target
819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe
-
Size
230KB
-
MD5
65c87fa0b7c308fff3e155b328b1690a
-
SHA1
4e84175dd432f24a9ed67cdd0a3ddf6612d96394
-
SHA256
819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32
-
SHA512
a4647eff5f43f0d1f0955f12fa0e3bd5c61f5cfb510e0e2c886392564c24811871838236bb28e85d6d4bd6026e1f350e7bc987f57677140716ecde1049ab05a1
-
SSDEEP
3072:TIMa5VPdnLAWeBIg5Si2mVvu3TRENKWH3xPALAiyEv7p5qyt/s7niwK/f+JuKtkk:GDAWw5NV4EBXWAIT/nw08xTm3E
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2064 svchost.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\46c33aef = "ÿVC³îÍ¥ûCäظô\x17o••:—…o?w$”_ƒ\x05)ÀQ—ÄÁëü\x18³að\x14L@\x14¸\x1f\x1cü+´gpù¸Ë,À_×éüdyÔ\u00904_QÌ9ÿ\t«\\tÑäÀŒ\x0fdùô!Ù€ù\x1b«ÿy›‘Ñ\x1c´1\u0090x9ç\x17\x17pp”çYœß÷\x17äÉÁ±K¸WaT\t\a›œ\u00a0ñHCÙǼ/çiQLÓ/tHÈa\x19\x0f¬—gÏ{ƒ\x1cLWp{¯ÿyè{gHI+¬WPa<Ç\tÌ¡/\a밳ܴWÌ\\Y‰¿¡¨¬g‰ïÐß\x0fW\x01\x19ÁTAA¬×\x17oa'‘gA˜aÛ™¸·±,‡¡\a\blçÿXÀ\u008f‘LwÄGX ÀÁA ´a¿™ <)«ØIy\x14Ï\u008fìç÷\\Ä" 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\46c33aef = "ÿVC³îÍ¥ûCäظô\x17o••:—…o?w$”_ƒ\x05)ÀQ—ÄÁëü\x18³að\x14L@\x14¸\x1f\x1cü+´gpù¸Ë,À_×éüdyÔ\u00904_QÌ9ÿ\t«\\tÑäÀŒ\x0fdùô!Ù€ù\x1b«ÿy›‘Ñ\x1c´1\u0090x9ç\x17\x17pp”çYœß÷\x17äÉÁ±K¸WaT\t\a›œ\u00a0ñHCÙǼ/çiQLÓ/tHÈa\x19\x0f¬—gÏ{ƒ\x1cLWp{¯ÿyè{gHI+¬WPa<Ç\tÌ¡/\a밳ܴWÌ\\Y‰¿¡¨¬g‰ïÐß\x0fW\x01\x19ÁTAA¬×\x17oa'‘gA˜aÛ™¸·±,‡¡\a\blçÿXÀ\u008f‘LwÄGX ÀÁA ´a¿™ <)«ØIy\x14Ï\u008fìç÷\\Ä" svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\svchost.exe 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe File opened for modification C:\Windows\apppatch\svchost.exe 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe 2064 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1488 wrote to memory of 2064 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe 79 PID 1488 wrote to memory of 2064 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe 79 PID 1488 wrote to memory of 2064 1488 819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe"C:\Users\Admin\AppData\Local\Temp\819b421a8a091a0188468672824fe5383be7ef8f4336b0a92916ca7a129adb32.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
PID:2064
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
230KB
MD5c77872c57177a1263d0c8d4f5d57fded
SHA1e9dcfc409ab85299f10dd2f1fd3fd298511ba7ed
SHA256a289538df3531740a97a663b65481d4e7b4d5a4baaba399ef4cb3c53cbc30ccb
SHA5126b402fc35e46c307d1b75b83d783c491d699a78d62dbf5065b8c3466d698a9395a21bd052b1316e5476687c7ab8d6ccba5d27de07c94ea3f3bb2bf59221979b2
-
Filesize
230KB
MD5c77872c57177a1263d0c8d4f5d57fded
SHA1e9dcfc409ab85299f10dd2f1fd3fd298511ba7ed
SHA256a289538df3531740a97a663b65481d4e7b4d5a4baaba399ef4cb3c53cbc30ccb
SHA5126b402fc35e46c307d1b75b83d783c491d699a78d62dbf5065b8c3466d698a9395a21bd052b1316e5476687c7ab8d6ccba5d27de07c94ea3f3bb2bf59221979b2