Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 12:59
Static task
static1
Behavioral task
behavioral1
Sample
ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Resource
win10v2004-20220812-en
General
-
Target
ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
-
Size
124KB
-
MD5
6607ec099b7945aedf71527c242b0bf8
-
SHA1
023d20cd841fc7faf7ce22e4509b6471c54cb042
-
SHA256
ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c
-
SHA512
3300875773d6282bfda41f429f2aa1030b9879bf0e30303d215a862623692494b2b0531d2a9d9aa7ffb77277c59834e8f13eaf5910f761edcf3b626aeffff238
-
SSDEEP
3072:azDJgFDoO+DtN0MQxPXQXYakWozv1z2M3g3uBkjvy1:aZgloPDtN0M2XwqJN2qg3umjvy1
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1368 Explorer.EXE 464 services.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-999675638-2867687379-27515722-1000\\$f545a6cb63874d75375b4ac5befd06b3\\n." ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$f545a6cb63874d75375b4ac5befd06b3\\n." ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini services.exe File created \systemroot\assembly\GAC_32\Desktop.ini services.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-999675638-2867687379-27515722-1000\\$f545a6cb63874d75375b4ac5befd06b3\\n." ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$f545a6cb63874d75375b4ac5befd06b3\\n." ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\clsid ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe 464 services.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe Token: SeDebugPrivilege 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe Token: SeDebugPrivilege 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe Token: SeDebugPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 748 wrote to memory of 1368 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe 17 PID 748 wrote to memory of 1368 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe 17 PID 748 wrote to memory of 464 748 ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe 2
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe"C:\Users\Admin\AppData\Local\Temp\ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe"2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5497ad85af4e8104630a238b4a208c3cd
SHA1037c6b04eac29281aa20fa4938ca3e4099a8c7c6
SHA2560ce64b5d9614480a89e8bcdad2f370a7ed9defae5195e24ce90494dae08b18d1
SHA5126c16e22744495efd55ca69cfb04c4e660852e55843222fae8c9bf3e6ba47de981bb0e5c67edd7c3f346d12727575c74b0a5b56c7bc008491c5da8f5acc989d57
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2