Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 23:29
Behavioral task
behavioral1
Sample
3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
General
-
Target
3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe
-
Size
350KB
-
MD5
61dbb42d14e7d603d236c60288685ad0
-
SHA1
b0a58d549087d8824a5f4f71e46506a96a5cefe2
-
SHA256
3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07
-
SHA512
fa7b66cfba7304f1b6a5b2ef2b1ea7d9fcb506eb3957cb61694b6f22c4b17d8ff6c18bfb46d123e4716f75fad3bcec1dd638af4b3ae55c2f8b954d31c75045dc
-
SSDEEP
6144:oyXu7IEBSsQ9ElMwm60lmqs7MTRGA3h3GVqdppJXEGhBukJF/KAwxFUOWdEmh:o3BdQLL4BE93NGVYZX9BukJlwxSJdEm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\59371d48.sys 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe File created C:\Windows\SysWOW64\drivers\259c28ce.sys 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Possible privilege escalation attempt 2 IoCs
pid Process 460 takeown.exe 576 icacls.exe -
Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\59371d48\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\59371d48.sys" 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\259c28ce\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\259c28ce.sys" 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
resource yara_rule behavioral1/memory/1488-54-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1488-56-0x0000000001000000-0x000000000112D000-memory.dmp upx behavioral1/memory/1488-61-0x0000000001000000-0x000000000112D000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1072 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 460 takeown.exe 576 icacls.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ws2tcpip.dll 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe File created C:\Windows\SysWOW64\wshtcpip.dll 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe File opened for modification C:\Windows\SysWOW64\goodsb.dll 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe File created C:\Windows\SysWOW64\goodsb.dll 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe File created C:\Windows\SysWOW64\ws2tcpip.dll 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe" 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "toir.dll" 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Suspicious behavior: LoadsDriver 5 IoCs
pid Process 464 Process not Found 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 464 Process not Found 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe Token: SeTakeOwnershipPrivilege 460 takeown.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1796 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 28 PID 1488 wrote to memory of 1796 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 28 PID 1488 wrote to memory of 1796 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 28 PID 1488 wrote to memory of 1796 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 28 PID 1796 wrote to memory of 460 1796 cmd.exe 30 PID 1796 wrote to memory of 460 1796 cmd.exe 30 PID 1796 wrote to memory of 460 1796 cmd.exe 30 PID 1796 wrote to memory of 460 1796 cmd.exe 30 PID 1796 wrote to memory of 576 1796 cmd.exe 31 PID 1796 wrote to memory of 576 1796 cmd.exe 31 PID 1796 wrote to memory of 576 1796 cmd.exe 31 PID 1796 wrote to memory of 576 1796 cmd.exe 31 PID 1488 wrote to memory of 1072 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 32 PID 1488 wrote to memory of 1072 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 32 PID 1488 wrote to memory of 1072 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 32 PID 1488 wrote to memory of 1072 1488 3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe"C:\Users\Admin\AppData\Local\Temp\3ab6974f1dc039b664885638f747e4e7d722d7fc5fc30ddbea491584241cfa07.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.execmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F2⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wshtcpip.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:460
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:576
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat2⤵
- Deletes itself
PID:1072
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD554671520f7273afc6d4ebc660d9b32df
SHA1baae797a8f52cb27d7297ef95fb46b976e2434f6
SHA256434f21a835545abb34d9c93a9afbf6ecdab03a32d5a97d938350a50a119ce4fc
SHA5121c68d52d60b4af22404498bea72eee40e30914da8ba95fc6ae32263f784f7e47b519f9d5a8883231ddc4b2ad783957ced7f78fef0a2807c3586a338d8579e816