Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 05:29
Behavioral task
behavioral1
Sample
7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
General
-
Target
7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe
-
Size
1.1MB
-
MD5
129ace256116b6572024b79bb2fa39ef
-
SHA1
7de3aa0adcdac2ac708e245bfe1f301170404899
-
SHA256
7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd
-
SHA512
fa02cca7c149206e397b7e082134ba36768d79db069955f51d04347512176b9578804de14087620ee2df3e9c27828eebf70b40b2157a74eee6dd5b36a734527a
-
SSDEEP
24576:InIE6iLcaqq9tH98ffJDtZjKARcmCBxTCcjAwhuZuPOYv8b:2dLcaq8cfJDtpK8czTRhuZuWqS
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1644 mscorsvw.exe 1416 mscorsvw.exe 968 OSE.EXE -
resource yara_rule behavioral1/memory/272-55-0x0000000000400000-0x0000000000560000-memory.dmp upx behavioral1/files/0x00010000000050f4-56.dat upx behavioral1/memory/1644-57-0x0000000010000000-0x0000000010070000-memory.dmp upx behavioral1/files/0x00010000000050f4-58.dat upx behavioral1/memory/1644-59-0x0000000010000000-0x0000000010070000-memory.dmp upx behavioral1/files/0x000100000000ecbb-60.dat upx behavioral1/memory/1416-61-0x0000000000400000-0x0000000000479000-memory.dmp upx behavioral1/files/0x00010000000103e1-63.dat upx behavioral1/memory/968-64-0x000000002E000000-0x000000002E086000-memory.dmp upx behavioral1/files/0x00010000000095de-66.dat upx behavioral1/memory/272-67-0x0000000000400000-0x0000000000560000-memory.dmp upx behavioral1/files/0x000100000000ecbb-68.dat upx behavioral1/files/0x00010000000115d6-69.dat upx behavioral1/files/0x0001000000009560-70.dat upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\S-1-5-21-3845472200-3839195424-595303356-1000 OSE.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc\S-1-5-21-3845472200-3839195424-595303356-1000\EnableNotifications = "0" OSE.EXE -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: OSE.EXE File opened (read-only) \??\U: OSE.EXE File opened (read-only) \??\I: OSE.EXE File opened (read-only) \??\L: OSE.EXE File opened (read-only) \??\Z: OSE.EXE File opened (read-only) \??\J: OSE.EXE File opened (read-only) \??\H: OSE.EXE File opened (read-only) \??\K: OSE.EXE File opened (read-only) \??\M: OSE.EXE File opened (read-only) \??\V: OSE.EXE File opened (read-only) \??\Y: OSE.EXE File opened (read-only) \??\F: OSE.EXE File opened (read-only) \??\G: OSE.EXE File opened (read-only) \??\N: OSE.EXE File opened (read-only) \??\O: OSE.EXE File opened (read-only) \??\Q: OSE.EXE File opened (read-only) \??\R: OSE.EXE File opened (read-only) \??\S: OSE.EXE File opened (read-only) \??\T: OSE.EXE File opened (read-only) \??\E: OSE.EXE File opened (read-only) \??\X: OSE.EXE File opened (read-only) \??\W: OSE.EXE -
Drops file in System32 directory 36 IoCs
description ioc Process File opened for modification \??\c:\windows\syswow64\perfhost.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\wbengine.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File created \??\c:\windows\SysWOW64\dllhost.vir 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File created \??\c:\windows\SysWOW64\searchindexer.vir 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\msdtc.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\svchost.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\vssvc.exe OSE.EXE File created \??\c:\windows\SysWOW64\msiexec.vir 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\lsass.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\dllhost.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File created \??\c:\windows\SysWOW64\svchost.vir 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe OSE.EXE File opened for modification \??\c:\windows\syswow64\perfhost.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\alg.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\locator.exe OSE.EXE File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe OSE.EXE File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe OSE.EXE File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File created \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.vir 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe OSE.EXE File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe OSE.EXE File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe OSE.EXE File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe OSE.EXE File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File created \??\c:\program files (x86)\microsoft office\office14\groove.vir 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe -
Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe OSE.EXE File opened for modification \??\c:\windows\ehome\ehsched.exe OSE.EXE File created \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.vir 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log mscorsvw.exe File opened for modification \??\c:\windows\ehome\ehsched.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe OSE.EXE File opened for modification \??\c:\windows\servicing\trustedinstaller.exe OSE.EXE File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe OSE.EXE File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat mscorsvw.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File created \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.vir 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe OSE.EXE File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe OSE.EXE File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe OSE.EXE File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{278AD5CF-E19D-4DFA-BBCB-AC19138F3672}.crmlog dllhost.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{278AD5CF-E19D-4DFA-BBCB-AC19138F3672}.crmlog dllhost.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe OSE.EXE File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe OSE.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 968 OSE.EXE 968 OSE.EXE 968 OSE.EXE 968 OSE.EXE 968 OSE.EXE 968 OSE.EXE 968 OSE.EXE 968 OSE.EXE 968 OSE.EXE 968 OSE.EXE 968 OSE.EXE 968 OSE.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 272 7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe Token: SeRestorePrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 436 msiexec.exe Token: SeSecurityPrivilege 436 msiexec.exe Token: SeTakeOwnershipPrivilege 968 OSE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe"C:\Users\Admin\AppData\Local\Temp\7c2bd6543ce4d99f1e0e7f9a560a1414542f444bb800e4fc2f04cf288f53d5cd.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:272
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1644
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
PID:1416
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
PID:896
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:436
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:968
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD5d714b3de70a618f05f33e4e3e33f3d93
SHA18c43e95b58c9091391b6b11928cf778348326dfd
SHA2569abd3240f7c01b252e13405ed19609690f265be2691a2e22722a0ff8c70757bf
SHA51284e87f3a8a758ae8ac0cb01a16204157916ab2eeb86736a3da0f3dcb94139cc12a1bacb781b9d5ea36d295ae6e80564a18e5cd097bb47c76b2613cf3253192b5
-
Filesize
203KB
MD5a4b431bd0a3888f7bc8c9fbe517f5ff0
SHA1f40ca11f31acc0ee9264148992baca10231b80ea
SHA25617dbe8cd947be1db7e9a0aeb884e56289e3f7cc03f081573346b170ccb2e97cf
SHA512009ed085d58cdc7e9868a3b0cbef7db8ef5596b12bda359045d7ba464dabab1cd922f111114e988638479efe878556f96581d6bda3a988bd01454fa1056f7d99
-
Filesize
203KB
MD5a4b431bd0a3888f7bc8c9fbe517f5ff0
SHA1f40ca11f31acc0ee9264148992baca10231b80ea
SHA25617dbe8cd947be1db7e9a0aeb884e56289e3f7cc03f081573346b170ccb2e97cf
SHA512009ed085d58cdc7e9868a3b0cbef7db8ef5596b12bda359045d7ba464dabab1cd922f111114e988638479efe878556f96581d6bda3a988bd01454fa1056f7d99
-
Filesize
234KB
MD58744629ce61d05b8fc1fe2e62a84b0d7
SHA14e8bc35ae0b1232a87cd5e9f374e719ea628aa8a
SHA256881bcfedfd989e91609e6b2f9db17a48078e27b5430a8a9f31778562f6744e06
SHA5129a0ad39cd23a5d385263188c2f433bc6c4c3eae2a3b4a46f9ce825537a11c2f9224c71dc8ebddb24633dacfdebe07ded30b7b96ca83bfb1a6b082f6b3f04707e
-
Filesize
29.7MB
MD53a1e59a617bf95823975876f8151e424
SHA1703da38ac061f45fbbbbf648dbf687af3a5ab2fd
SHA2561f2e4f24a501fab7a1331021618a513947976a27b9146d281abc9052e0206d1d
SHA512621df42611cd241e8036ba86a94c7a568788dd6dd0f2444305e396f4f4e9285ec8b1947440c0538fc43a17296e09059e4992682b5b9dfac052aaae73620b4886
-
Filesize
562KB
MD53ecc73ec958bd9e6dc047e9271539f91
SHA1831b3f436a7ce35dcd13e3fc8e72e1b8553bb28b
SHA256e4e85e0a058c443bd9397372659a59b123d5f63c9daf89cf32921a5bc4e9026b
SHA512a262ab996c09e59cf0e04c7e1bc8b3c9438f6fb32dca7a0373ac6896e6c58fad403618e9d4297da5b929e95c00946d5b236d463fc2a2d51699f544fe1d6ae484
-
Filesize
164KB
MD5d08d4d1e278c81e5c2072fd2d56140c4
SHA1cbff1983d103a8aa0fce94999b8713b33a2e3f03
SHA256b0400a5fab00d81e0cfd771e9f439dcbdad5fcf632c0adc3d578d95788e1a94a
SHA5122ef04ee1880dba0b230a0dab5b96391c417dac689bace2c078a22a6ba1d60186d978b394bd0da95aecfe9f7bfd8914d8cc3da1353bbad6c4b3bd4a3a64d7f4d1
-
Filesize
234KB
MD58744629ce61d05b8fc1fe2e62a84b0d7
SHA14e8bc35ae0b1232a87cd5e9f374e719ea628aa8a
SHA256881bcfedfd989e91609e6b2f9db17a48078e27b5430a8a9f31778562f6744e06
SHA5129a0ad39cd23a5d385263188c2f433bc6c4c3eae2a3b4a46f9ce825537a11c2f9224c71dc8ebddb24633dacfdebe07ded30b7b96ca83bfb1a6b082f6b3f04707e