Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
18/10/2022, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe
-
Size
464KB
-
MD5
fdf8218be046b3de1f56632d723b3990
-
SHA1
3987e62a0f46eac4b30c3fbec4e78c4419e85b3b
-
SHA256
7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334
-
SHA512
33d944c061d1e05b52c8bf1fd2c88434bc9f908225f0c78ad311bc03c699bd1dc1ea3c4591d4ca7c37dd12fcbc44b9c3c45c760d220d717ad52b5f78142cfd0b
-
SSDEEP
6144:yiNjjdOCJnUNKMEPDGeoo1HyisWW4g0QTxbGctE6Jm20tdVgWwAidpNCgrBF:TjjwULQoN84XQT08JoVgWwAkAQ
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x0006000000014930-56.dat aspack_v212_v242 behavioral1/files/0x0006000000014930-57.dat aspack_v212_v242 behavioral1/files/0x0006000000014930-65.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1520 sppsvc.exe -
Loads dropped DLL 4 IoCs
pid Process 1720 Regsvr32.exe 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 668 Regsvr32.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PFCW.EXE = "C:\\$Recycle.Bin\\wininit.exe" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run sppsvc.exe -
Enumerates connected drives 3 TTPs 36 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\L: sppsvc.exe File opened (read-only) \??\R: sppsvc.exe File opened (read-only) \??\G: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\H: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\K: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\I: sppsvc.exe File opened (read-only) \??\P: sppsvc.exe File opened (read-only) \??\U: sppsvc.exe File opened (read-only) \??\V: sppsvc.exe File opened (read-only) \??\E: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\I: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\V: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\H: sppsvc.exe File opened (read-only) \??\K: sppsvc.exe File opened (read-only) \??\M: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\F: sppsvc.exe File opened (read-only) \??\J: sppsvc.exe File opened (read-only) \??\N: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\R: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\E: sppsvc.exe File opened (read-only) \??\S: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\G: sppsvc.exe File opened (read-only) \??\Q: sppsvc.exe File opened (read-only) \??\N: sppsvc.exe File opened (read-only) \??\O: sppsvc.exe File opened (read-only) \??\T: sppsvc.exe File opened (read-only) \??\P: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\Q: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\M: sppsvc.exe File opened (read-only) \??\O: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\T: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\S: sppsvc.exe File opened (read-only) \??\F: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\J: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File opened (read-only) \??\L: 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\UVPCYTH.EXE 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File created C:\Windows\SysWOW64\Ms7002.dll 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File created C:\Windows\SysWOW64\QGEV.EXE sppsvc.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\VRIXH.EXE 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File created C:\Program Files (x86)\EAQMX.EXE 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe File created C:\Program Files (x86)\svchost.exe sppsvc.exe -
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ = "MaiHook7002" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32 Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\ = "MaiHook7002" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell sppsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\System Volume Information\\QCGCSNF.EXE \"%1\"" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\Users\\HUKWAFQ.EXE %1" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ProgID Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\System Volume Information\\UTERBS.EXE \"%1\"" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command sppsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Program Files\\VRIXH.EXE %1" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32\ = "C:\\Windows\\SysWow64\\Ms7002.dll" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32\ThreadingModel = "Apartment" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ProgID\ = "Ms7002.ShellExecuteHook" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile\qp7002 = "C:\\Windows\\SysWow64\\UVPCYTH.EXE" 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\Clsid\ = "{7CD4138D-4147-420B-9749-00A13B526785}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\Clsid Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command sppsvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open sppsvc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 1520 sppsvc.exe 1520 sppsvc.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1720 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 27 PID 1708 wrote to memory of 1720 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 27 PID 1708 wrote to memory of 1720 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 27 PID 1708 wrote to memory of 1720 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 27 PID 1708 wrote to memory of 1720 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 27 PID 1708 wrote to memory of 1720 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 27 PID 1708 wrote to memory of 1720 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 27 PID 1708 wrote to memory of 1520 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 28 PID 1708 wrote to memory of 1520 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 28 PID 1708 wrote to memory of 1520 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 28 PID 1708 wrote to memory of 1520 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 28 PID 1708 wrote to memory of 1520 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 28 PID 1708 wrote to memory of 1520 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 28 PID 1708 wrote to memory of 1520 1708 7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe 28 PID 1520 wrote to memory of 668 1520 sppsvc.exe 29 PID 1520 wrote to memory of 668 1520 sppsvc.exe 29 PID 1520 wrote to memory of 668 1520 sppsvc.exe 29 PID 1520 wrote to memory of 668 1520 sppsvc.exe 29 PID 1520 wrote to memory of 668 1520 sppsvc.exe 29 PID 1520 wrote to memory of 668 1520 sppsvc.exe 29 PID 1520 wrote to memory of 668 1520 sppsvc.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe"C:\Users\Admin\AppData\Local\Temp\7fe421f3fb5dc7b7d809bc340a8afff4a0f25d4597728f8c8e6df6cd23e61334.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32.exe C:\Windows\system32\Ms7002.dll /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:1720
-
-
C:\$Recycle.Bin\sppsvc.exeC:\$Recycle.Bin\sppsvc.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32.exe C:\Windows\system32\Ms7002.dll /s3⤵
- Loads dropped DLL
PID:668
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
464KB
MD581c612271d68b3323675e264ac5c184f
SHA16ab1cb5adf57c75f993fe7311c0a9f97367621cc
SHA256f4ae8117d85635c726e45dc1bcd400f4390c14c3492b6b36e068f149f26d2b06
SHA51216f9440a6a9ea35c322c27d724ff5d8001562af0129d4cb0115309f054b4f2c2409bc6b3a3a7c9ec2ef2d57576d1cd0a2b59f16bd00af4c14af8649ad08512b1
-
Filesize
464KB
MD581c612271d68b3323675e264ac5c184f
SHA16ab1cb5adf57c75f993fe7311c0a9f97367621cc
SHA256f4ae8117d85635c726e45dc1bcd400f4390c14c3492b6b36e068f149f26d2b06
SHA51216f9440a6a9ea35c322c27d724ff5d8001562af0129d4cb0115309f054b4f2c2409bc6b3a3a7c9ec2ef2d57576d1cd0a2b59f16bd00af4c14af8649ad08512b1
-
Filesize
52KB
MD5876a2a99b81968f5b26e3cbe12063d2b
SHA17afa8f33b691b2651b65eb07220cc2fda4b7537c
SHA256f0a7ec2edff7699e546221808f45ca8816a75eb519618283d7c4514dfb9134e0
SHA512ca0574dbb5ff4b146679ffc38aa794e64470949cd228518d04d3680d63a1ce2f076e38494fa5b6cd0722c2dc3e35c5b5c3b63483c1fa7dc62bca42c4cf8e0ce1
-
Filesize
464KB
MD581c612271d68b3323675e264ac5c184f
SHA16ab1cb5adf57c75f993fe7311c0a9f97367621cc
SHA256f4ae8117d85635c726e45dc1bcd400f4390c14c3492b6b36e068f149f26d2b06
SHA51216f9440a6a9ea35c322c27d724ff5d8001562af0129d4cb0115309f054b4f2c2409bc6b3a3a7c9ec2ef2d57576d1cd0a2b59f16bd00af4c14af8649ad08512b1
-
Filesize
464KB
MD581c612271d68b3323675e264ac5c184f
SHA16ab1cb5adf57c75f993fe7311c0a9f97367621cc
SHA256f4ae8117d85635c726e45dc1bcd400f4390c14c3492b6b36e068f149f26d2b06
SHA51216f9440a6a9ea35c322c27d724ff5d8001562af0129d4cb0115309f054b4f2c2409bc6b3a3a7c9ec2ef2d57576d1cd0a2b59f16bd00af4c14af8649ad08512b1
-
Filesize
52KB
MD5876a2a99b81968f5b26e3cbe12063d2b
SHA17afa8f33b691b2651b65eb07220cc2fda4b7537c
SHA256f0a7ec2edff7699e546221808f45ca8816a75eb519618283d7c4514dfb9134e0
SHA512ca0574dbb5ff4b146679ffc38aa794e64470949cd228518d04d3680d63a1ce2f076e38494fa5b6cd0722c2dc3e35c5b5c3b63483c1fa7dc62bca42c4cf8e0ce1
-
Filesize
52KB
MD5876a2a99b81968f5b26e3cbe12063d2b
SHA17afa8f33b691b2651b65eb07220cc2fda4b7537c
SHA256f0a7ec2edff7699e546221808f45ca8816a75eb519618283d7c4514dfb9134e0
SHA512ca0574dbb5ff4b146679ffc38aa794e64470949cd228518d04d3680d63a1ce2f076e38494fa5b6cd0722c2dc3e35c5b5c3b63483c1fa7dc62bca42c4cf8e0ce1