Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
02/10/2022, 16:52 UTC
General
-
Target
44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe
-
Size
667KB
-
MD5
300e3f51957787fe3a0a27572a80ad20
-
SHA1
b2ddf592123cba982e04199f759a902f61f40b44
-
SHA256
44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460
-
SHA512
27170c020b651a172707b0be18b0fc875a294dca53a9e86c464bf115f629cab9caa13bbd58ba4636103e5164628050d89171e5697e125d5269f400ca622d1b12
-
SSDEEP
6144:uRC0LS6V23ltSpcW3Go+jE7RkCrphFbaSKh8KBQexaZm:uRC0OqAnSCW29ARkghNvGYeoZm
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 49 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 37 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe"C:\Users\Admin\AppData\Local\Temp\44c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460.exe"1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4004 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5116 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
Network
-
DNSapi.bing.comRemote address:8.8.8.8:53Requestapi.bing.comIN AResponseapi.bing.comIN CNAMEapi-bing-com.e-0001.e-msedge.netapi-bing-com.e-0001.e-msedge.netIN CNAMEe-0001.e-msedge.nete-0001.e-msedge.netIN A13.107.5.80
-
93.184.220.29:80
-
52.168.117.170:443
-
8.252.51.254:80
-
8.253.183.120:80
-
104.80.225.205:443 -
209.197.3.8:80
-
204.79.197.200:443ieonline.microsoft.comtls, http2
-
8.8.8.8:53api.bing.comdns
DNS Request
api.bing.com
DNS Response
13.107.5.80
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
667KB
MD5300e3f51957787fe3a0a27572a80ad20
SHA1b2ddf592123cba982e04199f759a902f61f40b44
SHA25644c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460
SHA51227170c020b651a172707b0be18b0fc875a294dca53a9e86c464bf115f629cab9caa13bbd58ba4636103e5164628050d89171e5697e125d5269f400ca622d1b12
-
Filesize
667KB
MD5300e3f51957787fe3a0a27572a80ad20
SHA1b2ddf592123cba982e04199f759a902f61f40b44
SHA25644c0065f119ed6b9218102aba0ac2d030348dac2d4e90c2b768f21ebdd467460
SHA51227170c020b651a172707b0be18b0fc875a294dca53a9e86c464bf115f629cab9caa13bbd58ba4636103e5164628050d89171e5697e125d5269f400ca622d1b12
-
Filesize
471B
MD5fd70739fca5345a28f924f9102ae10ee
SHA16ce3f92183544f3bf52cb76364591589cb940a19
SHA256f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7
SHA512a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278
-
Filesize
471B
MD5fd70739fca5345a28f924f9102ae10ee
SHA16ce3f92183544f3bf52cb76364591589cb940a19
SHA256f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7
SHA512a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278
-
Filesize
404B
MD547a5c78770e7ed0d11d89cb045cc7303
SHA1161a8e501ffa447954b1e4d8b1161129aa47002b
SHA256b7d85489e67ac7c9ca467b05e738db0e15474b791cb8c2197c75cb8fde29b4ac
SHA512b8bcbacdd7132580e5e0e1c6e7db9512ba16cd5650b20289703c5b01b70d2dc597882c7617e200849f9c98aff312068d6f5fec7fb2f34d92c1ffe0f2942c5b63
-
Filesize
404B
MD5423e86aec034ce55bc2bde9f8de664ff
SHA17016bc3685bfd9796606065a4545ab3d3a80ed08
SHA25691fde2f7a4afaacaf2a291fe9ae06844d57dfffb71c7ec0857acfa901d14bfb6
SHA512bb6359221b9ad4146c5193b25956029dbe4d1d55c826ee9174eff30f78aaefb125d21e2b9eaf9610c65a9d54fab2fcdac529fda03f77726c49e4a7dd2932b167
-
Filesize
404B
MD5423e86aec034ce55bc2bde9f8de664ff
SHA17016bc3685bfd9796606065a4545ab3d3a80ed08
SHA25691fde2f7a4afaacaf2a291fe9ae06844d57dfffb71c7ec0857acfa901d14bfb6
SHA512bb6359221b9ad4146c5193b25956029dbe4d1d55c826ee9174eff30f78aaefb125d21e2b9eaf9610c65a9d54fab2fcdac529fda03f77726c49e4a7dd2932b167
-
Filesize
5KB
MD5b926d14c2e151fe020d69e241c8a4aa5
SHA18a0f51b7bd5f1aac402c9a1ad1f687d94340a7d0
SHA256f8fab701d5a2f84c72c65fbb759247872029c3dbd8043f9588b8c4724b618f31
SHA512d0efb876fd0e1c2248d7a07a6549e71b6f6a38e43445d5ad6e1ed4b2792d103c72dcc87e80b5651f4f3840964a11e8789b98f8096ba6a3093529f2d8f63d777e
-
Filesize
5KB
MD57f66d2d2f1d27fba217774b098797cc5
SHA16059cf3c36a0e77c06ab079c644b2e3b55b41d48
SHA256b5424e88db278d1d9263e32d51954d8c831513ca1f50dd0a4d52b6dc2fc94e53
SHA512fa196141fa61667eb7c125c9d3557a23f696ccf4806fe0e0467c3a8ac19c86ef5ea03edc6150c6577cf61eadd2862432143a63c601f29b11ca81c077c26493e0
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
712KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
712KB
-
Filesize
132KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB