Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 17:37
Static task
static1
Behavioral task
behavioral1
Sample
d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe
-
Size
229KB
-
MD5
4f4cc61af78b4504827dcda4294f8c9a
-
SHA1
40fc6ae4c8fe89cb2a4e2be2e62fb132aa392c8c
-
SHA256
d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa
-
SHA512
cbe2adf1effbe692b8d2f0555cdccce03f4dfe0f60c939981e6019a6f7b4dc39c370755c147a83643d1309ebe9068af4b0cf9a6083b7056607a5a3d02edbf6d1
-
SSDEEP
6144:XpoQ/WM4+jKUC4aL3q8Ii7ACcKsIEBEjheDRXy8A:eQeM4++UPauGps7B8epDA
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe -
Modifies security service 2 TTPs 26 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\DeleteFlag = "1" services.exe -
Deletes itself 1 IoCs
pid Process 1712 cmd.exe -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini services.exe File created \systemroot\assembly\GAC_32\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1952 set thread context of 1712 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 28 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Installer\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\@ d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 472 services.exe 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe Token: SeDebugPrivilege 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe Token: SeDebugPrivilege 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe Token: SeDebugPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe Token: SeBackupPrivilege 472 services.exe Token: SeRestorePrivilege 472 services.exe Token: SeSecurityPrivilege 472 services.exe Token: SeTakeOwnershipPrivilege 472 services.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1952 wrote to memory of 1196 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 15 PID 1952 wrote to memory of 472 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 2 PID 1952 wrote to memory of 1712 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 28 PID 1952 wrote to memory of 1712 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 28 PID 1952 wrote to memory of 1712 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 28 PID 1952 wrote to memory of 1712 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 28 PID 1952 wrote to memory of 1712 1952 d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe 28
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:472
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe"C:\Users\Admin\AppData\Local\Temp\d478c33a5a960b15c4b70d0f75b9ad4d10e59ae65da4161d5bc6ffdf902da5fa.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:1712
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5bcfacdcfba8b79bd44715dd7610d2c9a
SHA149bc1b671fe5e87f6716274e341923a013041d4a
SHA2565cc9d140fe7315ae1a86b199c54929a8284f5aafa3473c0eb8e2f71bb6388c6b
SHA51235886df3c3d0a1f81be7057285b445e4ec43df6c8bf548dd5ec74b01f41d372699f6dc2417e24b02737f6fd54595bbbb3c4578dbd311e2c7dde19c1f8c140f48