Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 23:07
Static task
static1
Behavioral task
behavioral1
Sample
8b2848db25a00f645822f12ccbb2c656d01b40d65987ad6350434306adb62ecc.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
8b2848db25a00f645822f12ccbb2c656d01b40d65987ad6350434306adb62ecc.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
8b2848db25a00f645822f12ccbb2c656d01b40d65987ad6350434306adb62ecc.dll
-
Size
78KB
-
MD5
4c945719abadac53692359c0e1be80f0
-
SHA1
48052fd7499fe8b1e7da7418c71550dba6897605
-
SHA256
8b2848db25a00f645822f12ccbb2c656d01b40d65987ad6350434306adb62ecc
-
SHA512
0a1053ec3d7b07951c8effce553e9a455e2673841ec8880d5d310b31ce3d2eb35635e371b9ad02ebd39d25d1f3f7542015c1ee4aaebc2ad54f9914330433d6c9
-
SSDEEP
1536:g0qfWT5MXE8hzFJw+pFr0qfWT5MB7NsP6JRHFoaUxra6H:bwWT5gtzTrpFIwWT5m7ay7FX8HH
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1640 hrlFF9.tmp 1840 ywkkso.exe -
Loads dropped DLL 3 IoCs
pid Process 1712 rundll32.exe 1712 rundll32.exe 1840 ywkkso.exe -
Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\H: ywkkso.exe File opened (read-only) \??\N: ywkkso.exe File opened (read-only) \??\V: ywkkso.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\K: ywkkso.exe File opened (read-only) \??\L: ywkkso.exe File opened (read-only) \??\R: ywkkso.exe File opened (read-only) \??\E: ywkkso.exe File opened (read-only) \??\O: ywkkso.exe File opened (read-only) \??\X: ywkkso.exe File opened (read-only) \??\Z: rundll32.exe File opened (read-only) \??\P: ywkkso.exe File opened (read-only) \??\T: ywkkso.exe File opened (read-only) \??\U: ywkkso.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\F: ywkkso.exe File opened (read-only) \??\S: ywkkso.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\G: ywkkso.exe File opened (read-only) \??\M: ywkkso.exe File opened (read-only) \??\W: ywkkso.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\I: ywkkso.exe File opened (read-only) \??\J: ywkkso.exe File opened (read-only) \??\Q: ywkkso.exe File opened (read-only) \??\Z: ywkkso.exe File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\Y: ywkkso.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\ywkkso.exe hrlFF9.tmp File opened for modification C:\Windows\SysWOW64\ywkkso.exe hrlFF9.tmp File created C:\Windows\SysWOW64\gei33.dll ywkkso.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\7-Zip\lpk.dll ywkkso.exe File opened for modification C:\Program Files\7-Zip\lpk.dll ywkkso.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1640 hrlFF9.tmp 1840 ywkkso.exe -
Suspicious behavior: MapViewOfSection 47 IoCs
pid Process 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1640 hrlFF9.tmp 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe 1840 ywkkso.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1640 hrlFF9.tmp Token: SeDebugPrivilege 1840 ywkkso.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1428 wrote to memory of 1712 1428 rundll32.exe 27 PID 1428 wrote to memory of 1712 1428 rundll32.exe 27 PID 1428 wrote to memory of 1712 1428 rundll32.exe 27 PID 1428 wrote to memory of 1712 1428 rundll32.exe 27 PID 1428 wrote to memory of 1712 1428 rundll32.exe 27 PID 1428 wrote to memory of 1712 1428 rundll32.exe 27 PID 1428 wrote to memory of 1712 1428 rundll32.exe 27 PID 1712 wrote to memory of 1640 1712 rundll32.exe 28 PID 1712 wrote to memory of 1640 1712 rundll32.exe 28 PID 1712 wrote to memory of 1640 1712 rundll32.exe 28 PID 1712 wrote to memory of 1640 1712 rundll32.exe 28 PID 1640 wrote to memory of 368 1640 hrlFF9.tmp 5 PID 1640 wrote to memory of 368 1640 hrlFF9.tmp 5 PID 1640 wrote to memory of 368 1640 hrlFF9.tmp 5 PID 1640 wrote to memory of 368 1640 hrlFF9.tmp 5 PID 1640 wrote to memory of 368 1640 hrlFF9.tmp 5 PID 1640 wrote to memory of 368 1640 hrlFF9.tmp 5 PID 1640 wrote to memory of 368 1640 hrlFF9.tmp 5 PID 1640 wrote to memory of 376 1640 hrlFF9.tmp 4 PID 1640 wrote to memory of 376 1640 hrlFF9.tmp 4 PID 1640 wrote to memory of 376 1640 hrlFF9.tmp 4 PID 1640 wrote to memory of 376 1640 hrlFF9.tmp 4 PID 1640 wrote to memory of 376 1640 hrlFF9.tmp 4 PID 1640 wrote to memory of 376 1640 hrlFF9.tmp 4 PID 1640 wrote to memory of 376 1640 hrlFF9.tmp 4 PID 1640 wrote to memory of 416 1640 hrlFF9.tmp 3 PID 1640 wrote to memory of 416 1640 hrlFF9.tmp 3 PID 1640 wrote to memory of 416 1640 hrlFF9.tmp 3 PID 1640 wrote to memory of 416 1640 hrlFF9.tmp 3 PID 1640 wrote to memory of 416 1640 hrlFF9.tmp 3 PID 1640 wrote to memory of 416 1640 hrlFF9.tmp 3 PID 1640 wrote to memory of 416 1640 hrlFF9.tmp 3 PID 1640 wrote to memory of 460 1640 hrlFF9.tmp 2 PID 1640 wrote to memory of 460 1640 hrlFF9.tmp 2 PID 1640 wrote to memory of 460 1640 hrlFF9.tmp 2 PID 1640 wrote to memory of 460 1640 hrlFF9.tmp 2 PID 1640 wrote to memory of 460 1640 hrlFF9.tmp 2 PID 1640 wrote to memory of 460 1640 hrlFF9.tmp 2 PID 1640 wrote to memory of 460 1640 hrlFF9.tmp 2 PID 1640 wrote to memory of 476 1640 hrlFF9.tmp 1 PID 1640 wrote to memory of 476 1640 hrlFF9.tmp 1 PID 1640 wrote to memory of 476 1640 hrlFF9.tmp 1 PID 1640 wrote to memory of 476 1640 hrlFF9.tmp 1 PID 1640 wrote to memory of 476 1640 hrlFF9.tmp 1 PID 1640 wrote to memory of 476 1640 hrlFF9.tmp 1 PID 1640 wrote to memory of 476 1640 hrlFF9.tmp 1 PID 1640 wrote to memory of 484 1640 hrlFF9.tmp 26 PID 1640 wrote to memory of 484 1640 hrlFF9.tmp 26 PID 1640 wrote to memory of 484 1640 hrlFF9.tmp 26 PID 1640 wrote to memory of 484 1640 hrlFF9.tmp 26 PID 1640 wrote to memory of 484 1640 hrlFF9.tmp 26 PID 1640 wrote to memory of 484 1640 hrlFF9.tmp 26 PID 1640 wrote to memory of 484 1640 hrlFF9.tmp 26 PID 1640 wrote to memory of 588 1640 hrlFF9.tmp 25 PID 1640 wrote to memory of 588 1640 hrlFF9.tmp 25 PID 1640 wrote to memory of 588 1640 hrlFF9.tmp 25 PID 1640 wrote to memory of 588 1640 hrlFF9.tmp 25 PID 1640 wrote to memory of 588 1640 hrlFF9.tmp 25 PID 1640 wrote to memory of 588 1640 hrlFF9.tmp 25 PID 1640 wrote to memory of 588 1640 hrlFF9.tmp 25 PID 1640 wrote to memory of 668 1640 hrlFF9.tmp 24 PID 1640 wrote to memory of 668 1640 hrlFF9.tmp 24 PID 1640 wrote to memory of 668 1640 hrlFF9.tmp 24 PID 1640 wrote to memory of 668 1640 hrlFF9.tmp 24
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:460
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:732
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:324
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1720
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:964
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1116
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1076
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:748
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:888
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:848
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:808
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:668
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:588
-
-
C:\Windows\SysWOW64\ywkkso.exeC:\Windows\SysWOW64\ywkkso.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:376
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1596
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1268
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b2848db25a00f645822f12ccbb2c656d01b40d65987ad6350434306adb62ecc.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b2848db25a00f645822f12ccbb2c656d01b40d65987ad6350434306adb62ecc.dll,#13⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\hrlFF9.tmpC:\Users\Admin\AppData\Local\Temp\hrlFF9.tmp4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD549f70000dd834768bf98ff77f73545b8
SHA1e2748467e2af4ceb779d171224008b0e45a03bf1
SHA2568eafe198416becabf3d7279877e7d90a4503f178763cd77aa42852ee6794a5af
SHA512e4facc8915fee3c45f0233be541a3a030f99d06efdece5ca11899e79241224eb031b527affcfae33d639be936558618a818ebb6d0904017f875dbf6688fb72b5
-
Filesize
66KB
MD549f70000dd834768bf98ff77f73545b8
SHA1e2748467e2af4ceb779d171224008b0e45a03bf1
SHA2568eafe198416becabf3d7279877e7d90a4503f178763cd77aa42852ee6794a5af
SHA512e4facc8915fee3c45f0233be541a3a030f99d06efdece5ca11899e79241224eb031b527affcfae33d639be936558618a818ebb6d0904017f875dbf6688fb72b5
-
Filesize
66KB
MD549f70000dd834768bf98ff77f73545b8
SHA1e2748467e2af4ceb779d171224008b0e45a03bf1
SHA2568eafe198416becabf3d7279877e7d90a4503f178763cd77aa42852ee6794a5af
SHA512e4facc8915fee3c45f0233be541a3a030f99d06efdece5ca11899e79241224eb031b527affcfae33d639be936558618a818ebb6d0904017f875dbf6688fb72b5
-
Filesize
66KB
MD549f70000dd834768bf98ff77f73545b8
SHA1e2748467e2af4ceb779d171224008b0e45a03bf1
SHA2568eafe198416becabf3d7279877e7d90a4503f178763cd77aa42852ee6794a5af
SHA512e4facc8915fee3c45f0233be541a3a030f99d06efdece5ca11899e79241224eb031b527affcfae33d639be936558618a818ebb6d0904017f875dbf6688fb72b5
-
Filesize
66KB
MD549f70000dd834768bf98ff77f73545b8
SHA1e2748467e2af4ceb779d171224008b0e45a03bf1
SHA2568eafe198416becabf3d7279877e7d90a4503f178763cd77aa42852ee6794a5af
SHA512e4facc8915fee3c45f0233be541a3a030f99d06efdece5ca11899e79241224eb031b527affcfae33d639be936558618a818ebb6d0904017f875dbf6688fb72b5
-
Filesize
66KB
MD549f70000dd834768bf98ff77f73545b8
SHA1e2748467e2af4ceb779d171224008b0e45a03bf1
SHA2568eafe198416becabf3d7279877e7d90a4503f178763cd77aa42852ee6794a5af
SHA512e4facc8915fee3c45f0233be541a3a030f99d06efdece5ca11899e79241224eb031b527affcfae33d639be936558618a818ebb6d0904017f875dbf6688fb72b5
-
Filesize
78KB
MD54c945719abadac53692359c0e1be80f0
SHA148052fd7499fe8b1e7da7418c71550dba6897605
SHA2568b2848db25a00f645822f12ccbb2c656d01b40d65987ad6350434306adb62ecc
SHA5120a1053ec3d7b07951c8effce553e9a455e2673841ec8880d5d310b31ce3d2eb35635e371b9ad02ebd39d25d1f3f7542015c1ee4aaebc2ad54f9914330433d6c9