Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe
Resource
win10v2004-20220812-en
General
-
Target
93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe
-
Size
236KB
-
MD5
15bd2eb33c00b4771079227eb1b7eb90
-
SHA1
0ca58f908247fb0fcc8271558501cbac65d17132
-
SHA256
93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37
-
SHA512
e157b160733398a71f3bdcb1c2338c37d3fabc3fdb6e39e95cf5c5296be5d267b610f68ea722fcca628686efa4e0f809b7a45ac32f9b48d1534627dcee409dc6
-
SSDEEP
3072:eKXxdEuTxsiVT0MjuV+pARwF/zQJLNP2yZroO70YVdBkKpkcpe2gvU:1dEuTxbB/pAulOLx/ZceBkNseJU
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\93ED4XRKS0.exe = "C:\\Users\\Admin\\AppData\\Roaming\\93ED4XRKS0.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\93ED4XRKS0.exe" 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCCCA2D7-3C3D-6D0D-7FFF-CA1A5A7CA1C8}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\93ED4XRKS0.exe" 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DCCCA2D7-3C3D-6D0D-7FFF-CA1A5A7CA1C8} 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DCCCA2D7-3C3D-6D0D-7FFF-CA1A5A7CA1C8}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\93ED4XRKS0.exe" 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCCCA2D7-3C3D-6D0D-7FFF-CA1A5A7CA1C8} 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe -
resource yara_rule behavioral2/memory/4788-134-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/4788-137-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/4788-138-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/4788-150-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\93ED4XRKS0.exe" 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\93ED4XRKS0.exe" 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4796 set thread context of 4788 4796 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 82 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2204 reg.exe 4372 reg.exe 2200 reg.exe 1180 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeCreateTokenPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeAssignPrimaryTokenPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeLockMemoryPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeIncreaseQuotaPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeMachineAccountPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeTcbPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeSecurityPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeTakeOwnershipPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeLoadDriverPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeSystemProfilePrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeSystemtimePrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeProfSingleProcessPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeIncBasePriorityPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeCreatePagefilePrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeCreatePermanentPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeBackupPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeRestorePrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeShutdownPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeDebugPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeAuditPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeSystemEnvironmentPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeChangeNotifyPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeRemoteShutdownPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeUndockPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeSyncAgentPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeEnableDelegationPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeManageVolumePrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeImpersonatePrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeCreateGlobalPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: 31 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: 32 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: 33 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: 34 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: 35 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe Token: SeDebugPrivilege 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4796 wrote to memory of 4788 4796 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 82 PID 4796 wrote to memory of 4788 4796 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 82 PID 4796 wrote to memory of 4788 4796 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 82 PID 4796 wrote to memory of 4788 4796 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 82 PID 4796 wrote to memory of 4788 4796 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 82 PID 4796 wrote to memory of 4788 4796 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 82 PID 4796 wrote to memory of 4788 4796 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 82 PID 4788 wrote to memory of 1624 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 83 PID 4788 wrote to memory of 1624 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 83 PID 4788 wrote to memory of 1624 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 83 PID 4788 wrote to memory of 4496 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 84 PID 4788 wrote to memory of 4496 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 84 PID 4788 wrote to memory of 4496 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 84 PID 4788 wrote to memory of 3180 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 85 PID 4788 wrote to memory of 3180 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 85 PID 4788 wrote to memory of 3180 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 85 PID 4788 wrote to memory of 1496 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 86 PID 4788 wrote to memory of 1496 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 86 PID 4788 wrote to memory of 1496 4788 93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe 86 PID 3180 wrote to memory of 1180 3180 cmd.exe 92 PID 3180 wrote to memory of 1180 3180 cmd.exe 92 PID 3180 wrote to memory of 1180 3180 cmd.exe 92 PID 4496 wrote to memory of 4372 4496 cmd.exe 94 PID 4496 wrote to memory of 4372 4496 cmd.exe 94 PID 4496 wrote to memory of 4372 4496 cmd.exe 94 PID 1624 wrote to memory of 2204 1624 cmd.exe 93 PID 1624 wrote to memory of 2204 1624 cmd.exe 93 PID 1624 wrote to memory of 2204 1624 cmd.exe 93 PID 1496 wrote to memory of 2200 1496 cmd.exe 91 PID 1496 wrote to memory of 2200 1496 cmd.exe 91 PID 1496 wrote to memory of 2200 1496 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe"C:\Users\Admin\AppData\Local\Temp\93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exeC:\Users\Admin\AppData\Local\Temp\93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2204
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\93f8ef9a878ac66d6dd24fcb4d3399f8e245841639f85b1aa90d558cb26aee37.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4372
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1180
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\93ED4XRKS0.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\93ED4XRKS0.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\93ED4XRKS0.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\93ED4XRKS0.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2200
-
-
-