Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe
Resource
win10v2004-20220812-en
General
-
Target
f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe
-
Size
108KB
-
MD5
62b2845c8526d0427800505bd3fb841b
-
SHA1
54c3b7a6668bd90c4ae491bb6aa990f35b35243b
-
SHA256
f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5
-
SHA512
1f5eca6a1123249551bf159617149c6195a2eab46dc5f7c5bad4d314c942c022392e0bcfcb5ba65bd30f6e999bffbf1193e081b588fe46bc7a461273d1538321
-
SSDEEP
1536:Q5eGgiOaTV+BA5uIpZo/QGoGG8betK4pkSQsVEj:Q5eLiO7GSuGGJ0V+Vm
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" lsass.exe -
Executes dropped EXE 1 IoCs
pid Process 1376 lsass.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2008 netsh.exe -
Deletes itself 1 IoCs
pid Process 1376 lsass.exe -
Loads dropped DLL 2 IoCs
pid Process 1720 f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe 1720 f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run lsass.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" lsass.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe\"" lsass.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1720 f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe 1376 lsass.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2008 1720 f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe 27 PID 1720 wrote to memory of 2008 1720 f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe 27 PID 1720 wrote to memory of 2008 1720 f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe 27 PID 1720 wrote to memory of 2008 1720 f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe 27 PID 1720 wrote to memory of 1376 1720 f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe 29 PID 1720 wrote to memory of 1376 1720 f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe 29 PID 1720 wrote to memory of 1376 1720 f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe 29 PID 1720 wrote to memory of 1376 1720 f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe"C:\Users\Admin\AppData\Local\Temp\f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\lsass.exe" CityScape Enable2⤵
- Modifies Windows Firewall
PID:2008
-
-
C:\Users\Admin\AppData\Roaming\lsass.exe/d C:\Users\Admin\AppData\Local\Temp\f94f453101a64eea061afffa5c35c95d1fce1ccf26583872f19a9e2a68be40c5.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1376
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD509698791cc99e3197344f26604a02fc5
SHA123969b4f75b728dcd14b9c6918d0196db652f743
SHA25672b5b4ac5d54c5c00323fa49472b0efab29759bf38a6e71b0c29ad9e9c1ba852
SHA512dc3c1b3bdbb0866ba482022f7ba273460953cc27d5af0ec21d10d3cdd8793c3ad3f6dbd0a9a4b79291300ee76e4b259593789b81325b7020ff355d4491964833
-
Filesize
108KB
MD509698791cc99e3197344f26604a02fc5
SHA123969b4f75b728dcd14b9c6918d0196db652f743
SHA25672b5b4ac5d54c5c00323fa49472b0efab29759bf38a6e71b0c29ad9e9c1ba852
SHA512dc3c1b3bdbb0866ba482022f7ba273460953cc27d5af0ec21d10d3cdd8793c3ad3f6dbd0a9a4b79291300ee76e4b259593789b81325b7020ff355d4491964833
-
Filesize
108KB
MD509698791cc99e3197344f26604a02fc5
SHA123969b4f75b728dcd14b9c6918d0196db652f743
SHA25672b5b4ac5d54c5c00323fa49472b0efab29759bf38a6e71b0c29ad9e9c1ba852
SHA512dc3c1b3bdbb0866ba482022f7ba273460953cc27d5af0ec21d10d3cdd8793c3ad3f6dbd0a9a4b79291300ee76e4b259593789b81325b7020ff355d4491964833