Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe
Resource
win10v2004-20220901-en
General
-
Target
bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe
-
Size
498KB
-
MD5
7d2c061c557f7eb942427819f6224718
-
SHA1
7f650ca69f17b2039476de0b64aa9ce920e6cdea
-
SHA256
bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327
-
SHA512
bf790488802876ec9ec26aeb1327790d0820f67495d242110f0745c63d04bb4bdea438e01ebd68fb59cf0d6ed3941bbcd02eb2b8b628903da03cf3cfcbc64364
-
SSDEEP
12288:PntjpKLofH/RKAYmsef8wB9G4hu7IURRQ5NFu6:/tjpiCfL3sefxHmvV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1768 fJ01804JeFlF01804.exe -
resource yara_rule behavioral1/memory/1284-55-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/1284-60-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/1768-64-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/1768-67-0x0000000000400000-0x00000000004CF000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1768 fJ01804JeFlF01804.exe -
Loads dropped DLL 2 IoCs
pid Process 1284 bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe 1284 bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\fJ01804JeFlF01804 = "C:\\ProgramData\\fJ01804JeFlF01804\\fJ01804JeFlF01804.exe" fJ01804JeFlF01804.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main fJ01804JeFlF01804.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1284 bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1284 bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe Token: SeDebugPrivilege 1768 fJ01804JeFlF01804.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1768 fJ01804JeFlF01804.exe 1768 fJ01804JeFlF01804.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1768 1284 bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe 27 PID 1284 wrote to memory of 1768 1284 bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe 27 PID 1284 wrote to memory of 1768 1284 bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe 27 PID 1284 wrote to memory of 1768 1284 bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe"C:\Users\Admin\AppData\Local\Temp\bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\ProgramData\fJ01804JeFlF01804\fJ01804JeFlF01804.exe"C:\ProgramData\fJ01804JeFlF01804\fJ01804JeFlF01804.exe" "C:\Users\Admin\AppData\Local\Temp\bd2ce1d29ac9d8b498942db60f6ed1a161737cefbf57b627b57ae589033f2327.exe"2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1768
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
498KB
MD5668576f3c8d5f15b7bfc61fe63f01dfb
SHA1626ea929f23d501a84dd928341cea4989a91344f
SHA256f7f47b8860a7237b3e7aa8b7b1e502231a8d9731d479e372031426acce19a54f
SHA512246121dea217832c8eb91e8c50be620345d9a957131df0a135d95711c890e140cf8bb23b1e56659d048db25bb27dc31a6a31ee0ed0bd8d50f2f02a800865f9aa
-
Filesize
498KB
MD5668576f3c8d5f15b7bfc61fe63f01dfb
SHA1626ea929f23d501a84dd928341cea4989a91344f
SHA256f7f47b8860a7237b3e7aa8b7b1e502231a8d9731d479e372031426acce19a54f
SHA512246121dea217832c8eb91e8c50be620345d9a957131df0a135d95711c890e140cf8bb23b1e56659d048db25bb27dc31a6a31ee0ed0bd8d50f2f02a800865f9aa
-
Filesize
498KB
MD5668576f3c8d5f15b7bfc61fe63f01dfb
SHA1626ea929f23d501a84dd928341cea4989a91344f
SHA256f7f47b8860a7237b3e7aa8b7b1e502231a8d9731d479e372031426acce19a54f
SHA512246121dea217832c8eb91e8c50be620345d9a957131df0a135d95711c890e140cf8bb23b1e56659d048db25bb27dc31a6a31ee0ed0bd8d50f2f02a800865f9aa
-
Filesize
498KB
MD5668576f3c8d5f15b7bfc61fe63f01dfb
SHA1626ea929f23d501a84dd928341cea4989a91344f
SHA256f7f47b8860a7237b3e7aa8b7b1e502231a8d9731d479e372031426acce19a54f
SHA512246121dea217832c8eb91e8c50be620345d9a957131df0a135d95711c890e140cf8bb23b1e56659d048db25bb27dc31a6a31ee0ed0bd8d50f2f02a800865f9aa