Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 03:10
Static task
static1
Behavioral task
behavioral1
Sample
fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe
Resource
win10v2004-20220812-en
General
-
Target
fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe
-
Size
688KB
-
MD5
55e82d0a0ee538ff911e36730ee8da40
-
SHA1
ffe4ffda16f1ef21ff6a57265aa93f1d6d84f222
-
SHA256
fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8
-
SHA512
823998123b6a03a52dc907279ad237b1035c07df197a4a1dd3027605211b81492f45d0d9ad2468291ffb57aab31c154b627f09b965e2138e73d38a50f2c69c7a
-
SSDEEP
6144:WTXUblJm7Cu9/cHDWLk9bLNZRgWLkmKc0VxS4ZJIh8q8x9dBrtdchM+GO:2UzmZGDp9bLNLgpl5Vxm8vdTEG
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{505142DC-3F86-4D53-9193-89C8A0D5E074}\\f5ea51da.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{505142DC-3F86-4D53-9193-89C8A0D5E074}\\f5ea51da.exe" svchost.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 544 set thread context of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf Process not Found -
Program crash 1 IoCs
pid pid_target Process procid_target 2036 1396 WerFault.exe 29 -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe -
Suspicious behavior: MapViewOfSection 25 IoCs
pid Process 1360 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 1360 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe 1396 svchost.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeDebugPrivilege 1396 svchost.exe Token: SeShutdownPrivilege 1352 Process not Found Token: SeAuditPrivilege 876 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 752 Process not Found -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 544 wrote to memory of 816 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 27 PID 544 wrote to memory of 816 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 27 PID 544 wrote to memory of 816 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 27 PID 544 wrote to memory of 816 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 27 PID 544 wrote to memory of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 PID 544 wrote to memory of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 PID 544 wrote to memory of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 PID 544 wrote to memory of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 PID 544 wrote to memory of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 PID 544 wrote to memory of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 PID 544 wrote to memory of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 PID 544 wrote to memory of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 PID 544 wrote to memory of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 PID 544 wrote to memory of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 PID 544 wrote to memory of 1360 544 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 28 PID 1360 wrote to memory of 1396 1360 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 29 PID 1360 wrote to memory of 1396 1360 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 29 PID 1360 wrote to memory of 1396 1360 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 29 PID 1360 wrote to memory of 1396 1360 fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe 29 PID 376 wrote to memory of 2036 376 Process not Found 30 PID 376 wrote to memory of 2036 376 Process not Found 30 PID 376 wrote to memory of 2036 376 Process not Found 30 PID 376 wrote to memory of 2036 376 Process not Found 30 PID 1396 wrote to memory of 2036 1396 svchost.exe 30 PID 1396 wrote to memory of 2036 1396 svchost.exe 30 PID 1396 wrote to memory of 2036 1396 svchost.exe 30 PID 1396 wrote to memory of 2036 1396 svchost.exe 30 PID 376 wrote to memory of 2036 376 Process not Found 30 PID 376 wrote to memory of 2036 376 Process not Found 30 PID 376 wrote to memory of 2036 376 Process not Found 30 PID 376 wrote to memory of 2036 376 Process not Found 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe"C:\Users\Admin\AppData\Local\Temp\fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe"C:\Users\Admin\AppData\Local\Temp\fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe"2⤵PID:816
-
-
C:\Users\Admin\AppData\Local\Temp\fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe"C:\Users\Admin\AppData\Local\Temp\fa28a5a8adb0dc346377f393c7a0882c1c8d122c62d84d8ea39a784bc997b6e8.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 4244⤵
- Program crash
PID:2036
-
-
-