Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    19s
  • max time network
    192s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 23:25

General

  • Target

    1dd33f920911bb18de7cb863a91a10b8696034200b9373e9935e22163e06e916.exe

  • Size

    234KB

  • MD5

    0038d9679b1286037034de0be583d574

  • SHA1

    b9e735daccb50a7c8de217076032e7f7e7cc3264

  • SHA256

    1dd33f920911bb18de7cb863a91a10b8696034200b9373e9935e22163e06e916

  • SHA512

    4693e05bc3d6c1dd4055147bdd43023d0e7421837002130a54c46a6b419fa80f102d7e761e2acc8c049695fdb5d22c3e0178ba213e1ce5157bf007d9862f11f7

  • SSDEEP

    6144:2xV8dI3bxRETtXaz/OJepymej5viyT5O/q9DUGEyoSQ:2n8dI3b7ETtKKepymejF5aeDUGNoSQ

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 36 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1dd33f920911bb18de7cb863a91a10b8696034200b9373e9935e22163e06e916.exe
    "C:\Users\Admin\AppData\Local\Temp\1dd33f920911bb18de7cb863a91a10b8696034200b9373e9935e22163e06e916.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Users\Admin\AppData\Local\Temp\1dd33f920911bb18de7cb863a91a10b8696034200b9373e9935e22163e06e916.exe
      "C:\Users\Admin\AppData\Local\Temp\1dd33f920911bb18de7cb863a91a10b8696034200b9373e9935e22163e06e916.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:684
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /renew
        3⤵
        • Gathers network information
        PID:1372
    • C:\Users\Admin\AppData\Local\Temp\1dd33f920911bb18de7cb863a91a10b8696034200b9373e9935e22163e06e916.exe
      "C:\Users\Admin\AppData\Local\Temp\1dd33f920911bb18de7cb863a91a10b8696034200b9373e9935e22163e06e916.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2020
      • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe
        "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"
        3⤵
          PID:892
          • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe
            "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"
            4⤵
              PID:956
            • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe
              "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"
              4⤵
                PID:1492
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\YOPMV.bat" "
                  5⤵
                    PID:1712
                    • C:\Windows\SysWOW64\reg.exe
                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SkipeTurns" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe" /f
                      6⤵
                        PID:2000
                  • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe
                    "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"
                    4⤵
                      PID:1772
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                        5⤵
                          PID:1468
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                            6⤵
                            • Modifies registry key
                            PID:944
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe:*:Enabled:Windows Messanger" /f
                          5⤵
                            PID:1864
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe:*:Enabled:Windows Messanger" /f
                              6⤵
                              • Modifies registry key
                              PID:988
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                            5⤵
                              PID:1632
                              • C:\Windows\SysWOW64\reg.exe
                                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                                6⤵
                                • Modifies registry key
                                PID:1844
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DarkEye2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DarkEye2.exe:*:Enabled:Windows Messanger" /f
                              5⤵
                                PID:1880
                                • C:\Windows\SysWOW64\reg.exe
                                  REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DarkEye2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DarkEye2.exe:*:Enabled:Windows Messanger" /f
                                  6⤵
                                  • Modifies registry key
                                  PID:2036

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\YOPMV.bat

                        Filesize

                        142B

                        MD5

                        7aab82a958be0bdc325ec075c874ca64

                        SHA1

                        f4ab3d6776f6ffc569a878a003df9a4f0a331eb6

                        SHA256

                        446e766a1c4c57cf38c3b70b1152a5c1216cc86388fefe5d7d39522458436144

                        SHA512

                        1737e41a539341737e4fc5c22f13c10b34e5054b2e1b44e604490c4faaf943442c596581fb28b0c967935cfd92c5fd4e7331fb72ae2d4f6ef1b8acc64b46f240

                      • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe

                        Filesize

                        234KB

                        MD5

                        5afd41c66fc4ac8cf57667ff4c8d0ad7

                        SHA1

                        b2025aa74cf83dae692ac0b88ef1f2e8f2e30c60

                        SHA256

                        88522af5f557d05a8723924ba5e507c22177ec0a157c22e7f0248e38a027a93d

                        SHA512

                        f58f8885ee22dbdd824e3ecd50c1d4e28f237ca8fa4222bf20ee12d38065e88ae8c4f2342ccaa7440b8521ffa1258850ed920243918892e8d2aeb972ce3ffb8f

                      • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe

                        Filesize

                        234KB

                        MD5

                        5afd41c66fc4ac8cf57667ff4c8d0ad7

                        SHA1

                        b2025aa74cf83dae692ac0b88ef1f2e8f2e30c60

                        SHA256

                        88522af5f557d05a8723924ba5e507c22177ec0a157c22e7f0248e38a027a93d

                        SHA512

                        f58f8885ee22dbdd824e3ecd50c1d4e28f237ca8fa4222bf20ee12d38065e88ae8c4f2342ccaa7440b8521ffa1258850ed920243918892e8d2aeb972ce3ffb8f

                      • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe

                        Filesize

                        234KB

                        MD5

                        5afd41c66fc4ac8cf57667ff4c8d0ad7

                        SHA1

                        b2025aa74cf83dae692ac0b88ef1f2e8f2e30c60

                        SHA256

                        88522af5f557d05a8723924ba5e507c22177ec0a157c22e7f0248e38a027a93d

                        SHA512

                        f58f8885ee22dbdd824e3ecd50c1d4e28f237ca8fa4222bf20ee12d38065e88ae8c4f2342ccaa7440b8521ffa1258850ed920243918892e8d2aeb972ce3ffb8f

                      • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe

                        Filesize

                        234KB

                        MD5

                        5afd41c66fc4ac8cf57667ff4c8d0ad7

                        SHA1

                        b2025aa74cf83dae692ac0b88ef1f2e8f2e30c60

                        SHA256

                        88522af5f557d05a8723924ba5e507c22177ec0a157c22e7f0248e38a027a93d

                        SHA512

                        f58f8885ee22dbdd824e3ecd50c1d4e28f237ca8fa4222bf20ee12d38065e88ae8c4f2342ccaa7440b8521ffa1258850ed920243918892e8d2aeb972ce3ffb8f

                      • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe

                        Filesize

                        234KB

                        MD5

                        5afd41c66fc4ac8cf57667ff4c8d0ad7

                        SHA1

                        b2025aa74cf83dae692ac0b88ef1f2e8f2e30c60

                        SHA256

                        88522af5f557d05a8723924ba5e507c22177ec0a157c22e7f0248e38a027a93d

                        SHA512

                        f58f8885ee22dbdd824e3ecd50c1d4e28f237ca8fa4222bf20ee12d38065e88ae8c4f2342ccaa7440b8521ffa1258850ed920243918892e8d2aeb972ce3ffb8f

                      • \Users\Admin\AppData\Roaming\SkipeTurns.exe

                        Filesize

                        234KB

                        MD5

                        5afd41c66fc4ac8cf57667ff4c8d0ad7

                        SHA1

                        b2025aa74cf83dae692ac0b88ef1f2e8f2e30c60

                        SHA256

                        88522af5f557d05a8723924ba5e507c22177ec0a157c22e7f0248e38a027a93d

                        SHA512

                        f58f8885ee22dbdd824e3ecd50c1d4e28f237ca8fa4222bf20ee12d38065e88ae8c4f2342ccaa7440b8521ffa1258850ed920243918892e8d2aeb972ce3ffb8f

                      • \Users\Admin\AppData\Roaming\SkipeTurns.exe

                        Filesize

                        234KB

                        MD5

                        5afd41c66fc4ac8cf57667ff4c8d0ad7

                        SHA1

                        b2025aa74cf83dae692ac0b88ef1f2e8f2e30c60

                        SHA256

                        88522af5f557d05a8723924ba5e507c22177ec0a157c22e7f0248e38a027a93d

                        SHA512

                        f58f8885ee22dbdd824e3ecd50c1d4e28f237ca8fa4222bf20ee12d38065e88ae8c4f2342ccaa7440b8521ffa1258850ed920243918892e8d2aeb972ce3ffb8f

                      • \Users\Admin\AppData\Roaming\SkipeTurns.exe

                        Filesize

                        234KB

                        MD5

                        5afd41c66fc4ac8cf57667ff4c8d0ad7

                        SHA1

                        b2025aa74cf83dae692ac0b88ef1f2e8f2e30c60

                        SHA256

                        88522af5f557d05a8723924ba5e507c22177ec0a157c22e7f0248e38a027a93d

                        SHA512

                        f58f8885ee22dbdd824e3ecd50c1d4e28f237ca8fa4222bf20ee12d38065e88ae8c4f2342ccaa7440b8521ffa1258850ed920243918892e8d2aeb972ce3ffb8f

                      • \Users\Admin\AppData\Roaming\SkipeTurns.exe

                        Filesize

                        234KB

                        MD5

                        5afd41c66fc4ac8cf57667ff4c8d0ad7

                        SHA1

                        b2025aa74cf83dae692ac0b88ef1f2e8f2e30c60

                        SHA256

                        88522af5f557d05a8723924ba5e507c22177ec0a157c22e7f0248e38a027a93d

                        SHA512

                        f58f8885ee22dbdd824e3ecd50c1d4e28f237ca8fa4222bf20ee12d38065e88ae8c4f2342ccaa7440b8521ffa1258850ed920243918892e8d2aeb972ce3ffb8f

                      • \Users\Admin\AppData\Roaming\SkipeTurns.exe

                        Filesize

                        234KB

                        MD5

                        5afd41c66fc4ac8cf57667ff4c8d0ad7

                        SHA1

                        b2025aa74cf83dae692ac0b88ef1f2e8f2e30c60

                        SHA256

                        88522af5f557d05a8723924ba5e507c22177ec0a157c22e7f0248e38a027a93d

                        SHA512

                        f58f8885ee22dbdd824e3ecd50c1d4e28f237ca8fa4222bf20ee12d38065e88ae8c4f2342ccaa7440b8521ffa1258850ed920243918892e8d2aeb972ce3ffb8f

                      • memory/684-60-0x0000000000400000-0x000000000040C000-memory.dmp

                        Filesize

                        48KB

                      • memory/684-68-0x0000000000400000-0x000000000040C000-memory.dmp

                        Filesize

                        48KB

                      • memory/684-56-0x0000000000400000-0x000000000040C000-memory.dmp

                        Filesize

                        48KB

                      • memory/684-81-0x0000000000400000-0x000000000040C000-memory.dmp

                        Filesize

                        48KB

                      • memory/684-82-0x0000000000400000-0x000000000040C000-memory.dmp

                        Filesize

                        48KB

                      • memory/684-66-0x0000000000400000-0x000000000040C000-memory.dmp

                        Filesize

                        48KB

                      • memory/684-59-0x0000000000400000-0x000000000040C000-memory.dmp

                        Filesize

                        48KB

                      • memory/684-57-0x0000000000400000-0x000000000040C000-memory.dmp

                        Filesize

                        48KB

                      • memory/892-131-0x0000000000400000-0x00000000004DF000-memory.dmp

                        Filesize

                        892KB

                      • memory/892-122-0x0000000000400000-0x00000000004DF000-memory.dmp

                        Filesize

                        892KB

                      • memory/956-124-0x0000000000400000-0x000000000040C000-memory.dmp

                        Filesize

                        48KB

                      • memory/1372-80-0x0000000075E31000-0x0000000075E33000-memory.dmp

                        Filesize

                        8KB

                      • memory/1492-142-0x0000000000400000-0x0000000000410000-memory.dmp

                        Filesize

                        64KB

                      • memory/1644-76-0x0000000000400000-0x00000000004DF000-memory.dmp

                        Filesize

                        892KB

                      • memory/1772-118-0x0000000000400000-0x000000000047B000-memory.dmp

                        Filesize

                        492KB

                      • memory/1772-116-0x0000000000400000-0x000000000047B000-memory.dmp

                        Filesize

                        492KB

                      • memory/1772-123-0x0000000000400000-0x000000000047B000-memory.dmp

                        Filesize

                        492KB

                      • memory/1772-121-0x0000000000400000-0x000000000047B000-memory.dmp

                        Filesize

                        492KB

                      • memory/1772-132-0x0000000000400000-0x000000000047B000-memory.dmp

                        Filesize

                        492KB

                      • memory/1772-149-0x0000000000400000-0x000000000047B000-memory.dmp

                        Filesize

                        492KB

                      • memory/1772-130-0x0000000000400000-0x000000000047B000-memory.dmp

                        Filesize

                        492KB

                      • memory/1772-136-0x0000000000400000-0x000000000047B000-memory.dmp

                        Filesize

                        492KB

                      • memory/2020-83-0x0000000000400000-0x0000000000410000-memory.dmp

                        Filesize

                        64KB

                      • memory/2020-69-0x0000000000400000-0x0000000000410000-memory.dmp

                        Filesize

                        64KB

                      • memory/2020-74-0x0000000000400000-0x0000000000410000-memory.dmp

                        Filesize

                        64KB

                      • memory/2020-67-0x0000000000400000-0x0000000000410000-memory.dmp

                        Filesize

                        64KB

                      • memory/2020-64-0x0000000000400000-0x0000000000410000-memory.dmp

                        Filesize

                        64KB

                      • memory/2020-63-0x0000000000400000-0x0000000000410000-memory.dmp

                        Filesize

                        64KB

                      • memory/2020-133-0x0000000000400000-0x0000000000410000-memory.dmp

                        Filesize

                        64KB

                      • memory/2020-75-0x0000000000400000-0x0000000000410000-memory.dmp

                        Filesize

                        64KB

                      • memory/2020-91-0x0000000002C70000-0x0000000002D4F000-memory.dmp

                        Filesize

                        892KB