Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe
Resource
win10v2004-20220812-en
General
-
Target
100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe
-
Size
156KB
-
MD5
6820d7cf55c1a44896421b4b33b886f0
-
SHA1
9e05299c85f78c316f0a98cf8106879d5fee6768
-
SHA256
100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3
-
SHA512
5f2398cca3b26b788acabc40f686768a5de41a4f04a75ba4040c5338388718d054f1058f27c10655c5cd418d44577e2bf6ebaece68d7de368985d75b2e428800
-
SSDEEP
3072:VgbKzcKpSf5GDH8cRtWl2zZoZlbzzd5GLcCXG8WPsd:YKzcKpE56cjYWfWX
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1396 Explorer.EXE 460 services.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-999675638-2867687379-27515722-1000\\$f545a6cb63874d75375b4ac5befd06b3\\n." 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$f545a6cb63874d75375b4ac5befd06b3\\n." 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe -
Deletes itself 1 IoCs
pid Process 792 cmd.exe -
Unexpected DNS network traffic destination 9 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini services.exe File created \systemroot\assembly\GAC_32\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1504 set thread context of 792 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 26 -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\clsid 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-999675638-2867687379-27515722-1000\\$f545a6cb63874d75375b4ac5befd06b3\\n." 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$f545a6cb63874d75375b4ac5befd06b3\\n." 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 460 services.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe Token: SeDebugPrivilege 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe Token: SeDebugPrivilege 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe Token: SeDebugPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1396 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 12 PID 1504 wrote to memory of 1396 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 12 PID 1504 wrote to memory of 460 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 2 PID 1504 wrote to memory of 792 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 26 PID 1504 wrote to memory of 792 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 26 PID 1504 wrote to memory of 792 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 26 PID 1504 wrote to memory of 792 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 26 PID 1504 wrote to memory of 792 1504 100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe 26
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe"C:\Users\Admin\AppData\Local\Temp\100795b11f351f589fe795ea4539948b487a0ac69630fd32b6f847c071a74fb3.exe"2⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:792
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5ee9028a95cc99c4658e4a8f1a979d416
SHA137bfb7e64fbf3e785618b927260ffe94e680dfca
SHA256cb1e8c2918d125e04d19edc92e1ade15a604d6b36c5e5f7f68caaada6068a10d
SHA512e8ef6a1e2114b568ecdd7efe95ec411f6fdd6534229987e1a40edc3d616de5692dd134ccb3ab1baf653bb902c2520c9dcb0d4b720d4087aee3cbf7c0f406b19d
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2