Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 08:11
Static task
static1
Behavioral task
behavioral1
Sample
25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe
Resource
win10v2004-20220812-en
General
-
Target
25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe
-
Size
528KB
-
MD5
75cded002eb441aef67af3e5cc97c49d
-
SHA1
8588a13aaa8ae50609e419dea32f363ad8f6d704
-
SHA256
25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0
-
SHA512
d6c63e4b72975cf787b637f26bbac5dd6276abf1bb0a240020b78d70f7921371ab5730a88c47ade38ff5b3c026075c435a02d99eeea58c2d1708d100f6aa86f7
-
SSDEEP
12288:O1T9O/qYv8/iWlq0bZBZsI+oG1KsFXyeIeoU1:Ak0bNs9FtyeI+1
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\beard.exe = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe:*:Enabled:Windows Messanger" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3328 set thread context of 3888 3328 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 78 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4404 reg.exe 4104 reg.exe 956 reg.exe 4212 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeCreateTokenPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeAssignPrimaryTokenPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeLockMemoryPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeIncreaseQuotaPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeMachineAccountPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeTcbPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeSecurityPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeTakeOwnershipPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeLoadDriverPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeSystemProfilePrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeSystemtimePrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeProfSingleProcessPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeIncBasePriorityPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeCreatePagefilePrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeCreatePermanentPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeBackupPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeRestorePrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeShutdownPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeDebugPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeAuditPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeSystemEnvironmentPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeChangeNotifyPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeRemoteShutdownPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeUndockPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeSyncAgentPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeEnableDelegationPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeManageVolumePrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeImpersonatePrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeCreateGlobalPrivilege 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: 31 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: 32 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: 33 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: 34 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: 35 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3328 wrote to memory of 3888 3328 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 78 PID 3328 wrote to memory of 3888 3328 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 78 PID 3328 wrote to memory of 3888 3328 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 78 PID 3328 wrote to memory of 3888 3328 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 78 PID 3328 wrote to memory of 3888 3328 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 78 PID 3328 wrote to memory of 3888 3328 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 78 PID 3328 wrote to memory of 3888 3328 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 78 PID 3328 wrote to memory of 3888 3328 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 78 PID 3888 wrote to memory of 4284 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 79 PID 3888 wrote to memory of 4284 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 79 PID 3888 wrote to memory of 4284 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 79 PID 3888 wrote to memory of 3052 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 80 PID 3888 wrote to memory of 3052 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 80 PID 3888 wrote to memory of 3052 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 80 PID 3888 wrote to memory of 2324 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 81 PID 3888 wrote to memory of 2324 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 81 PID 3888 wrote to memory of 2324 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 81 PID 3888 wrote to memory of 1756 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 86 PID 3888 wrote to memory of 1756 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 86 PID 3888 wrote to memory of 1756 3888 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 86 PID 3052 wrote to memory of 4404 3052 cmd.exe 87 PID 3052 wrote to memory of 4404 3052 cmd.exe 87 PID 3052 wrote to memory of 4404 3052 cmd.exe 87 PID 2324 wrote to memory of 4104 2324 cmd.exe 88 PID 2324 wrote to memory of 4104 2324 cmd.exe 88 PID 2324 wrote to memory of 4104 2324 cmd.exe 88 PID 4284 wrote to memory of 956 4284 cmd.exe 89 PID 4284 wrote to memory of 956 4284 cmd.exe 89 PID 4284 wrote to memory of 956 4284 cmd.exe 89 PID 1756 wrote to memory of 4212 1756 cmd.exe 90 PID 1756 wrote to memory of 4212 1756 cmd.exe 90 PID 1756 wrote to memory of 4212 1756 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe"C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe"C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:956
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4404
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4104
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4212
-
-
-