Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 23:53
Static task
static1
Behavioral task
behavioral1
Sample
d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe
Resource
win7-20220812-en
General
-
Target
d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe
-
Size
1.4MB
-
MD5
34dbc284ee742adf9ab6d0e749d55ab0
-
SHA1
91c50cef6a4d3bf1ed3ffbe70041a730932601d4
-
SHA256
d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999
-
SHA512
a4a02a6e46adcee086d988d9034f68df1704b90b349ea973ea35ba68ee44e27302c3811349c7dd357fa32fe80c228399c6c619d032eee5813287b576662dce01
-
SSDEEP
24576:ONmF/mnBoDM5f7F2JQRKZk+61i5cCPWZj+VhL8OamPRKplJfVXT24WTEvzHJDsZ:OYVZo5TcJQqk+61i5cYWZjSTDPYtfVji
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1092 ms.exe -
Possible privilege escalation attempt 2 IoCs
pid Process 5108 takeown.exe 4092 icacls.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 5108 takeown.exe 4092 icacls.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\WINDOWS\Bef.tmp d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe File opened for modification C:\Windows\yre.tmp d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5108 takeown.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1092 ms.exe 1092 ms.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3012 wrote to memory of 1092 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 83 PID 3012 wrote to memory of 1092 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 83 PID 3012 wrote to memory of 1092 3012 d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe 83 PID 1092 wrote to memory of 5108 1092 ms.exe 84 PID 1092 wrote to memory of 5108 1092 ms.exe 84 PID 1092 wrote to memory of 4092 1092 ms.exe 86 PID 1092 wrote to memory of 4092 1092 ms.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe"C:\Users\Admin\AppData\Local\Temp\d041dabeca1eb963541240cdbd8619068ed36a42e16d649c866e375dc4c99999.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\ms.exeC:\Users\Admin\AppData\Local\Temp\ms.exe k2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SYSTEM32\takeown.exetakeown /f "C:\WINDOWS\system32\Sens.dll"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
-
C:\Windows\SYSTEM32\icacls.exeicacls "C:\WINDOWS\system32\Sens.dll" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4092
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
424KB
MD5a6c6dc74d7f061d01ef9b2cc4451a760
SHA146158a4b95126d95e0187ce066126c9482b44568
SHA256c63e23d1efe9bbb79cb80def879c087fafe4ee4dfb4e8918cb0bc9ac72db0915
SHA512800236114c6f9a5a25b425a2ba1f118250b6ecc7d935fa980b2e9408c0d8d1991c2be5fc698ca951375c0fb0d79edd878c323bd230bb7084c2fe7f1362deb3bd
-
Filesize
424KB
MD5a6c6dc74d7f061d01ef9b2cc4451a760
SHA146158a4b95126d95e0187ce066126c9482b44568
SHA256c63e23d1efe9bbb79cb80def879c087fafe4ee4dfb4e8918cb0bc9ac72db0915
SHA512800236114c6f9a5a25b425a2ba1f118250b6ecc7d935fa980b2e9408c0d8d1991c2be5fc698ca951375c0fb0d79edd878c323bd230bb7084c2fe7f1362deb3bd