Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 02:06
Static task
static1
Behavioral task
behavioral1
Sample
3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe
-
Size
420KB
-
MD5
7d1b53499cad529cc9d7802629c2e910
-
SHA1
d96db968e5f75410563e4f6600dab4ebbd6792ba
-
SHA256
3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096
-
SHA512
4c8e96c1bdb1bf897cb771a8c18e9a62cea7fd71ff305a2f8855959d15bff53019561409bdb88149676266a32aef41cfed4f95bf4d54caca923a941106775f35
-
SSDEEP
6144:zK3HTNGVvHI2zBHng5HaVsbZgRnyR4mULJhkHM6jI7H1D7puVSC:23HcVvo21ga0aQ4HLJhkHM6jI7VD7wf
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\NV00V6M540.exe = "C:\\Users\\Admin\\AppData\\Roaming\\NV00V6M540.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2012 reg.exe 904 reg.exe 908 reg.exe 336 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeCreateTokenPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeAssignPrimaryTokenPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeLockMemoryPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeIncreaseQuotaPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeMachineAccountPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeTcbPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeSecurityPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeTakeOwnershipPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeLoadDriverPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeSystemProfilePrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeSystemtimePrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeProfSingleProcessPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeIncBasePriorityPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeCreatePagefilePrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeCreatePermanentPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeBackupPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeRestorePrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeShutdownPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeDebugPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeAuditPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeSystemEnvironmentPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeChangeNotifyPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeRemoteShutdownPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeUndockPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeSyncAgentPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeEnableDelegationPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeManageVolumePrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeImpersonatePrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeCreateGlobalPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: 31 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: 32 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: 33 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: 34 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: 35 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeDebugPrivilege 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1116 wrote to memory of 1320 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 26 PID 1116 wrote to memory of 1320 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 26 PID 1116 wrote to memory of 1320 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 26 PID 1116 wrote to memory of 1320 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 26 PID 1116 wrote to memory of 1688 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 28 PID 1116 wrote to memory of 1688 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 28 PID 1116 wrote to memory of 1688 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 28 PID 1116 wrote to memory of 1688 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 28 PID 1116 wrote to memory of 1524 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 29 PID 1116 wrote to memory of 1524 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 29 PID 1116 wrote to memory of 1524 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 29 PID 1116 wrote to memory of 1524 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 29 PID 1116 wrote to memory of 1632 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 31 PID 1116 wrote to memory of 1632 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 31 PID 1116 wrote to memory of 1632 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 31 PID 1116 wrote to memory of 1632 1116 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 31 PID 1688 wrote to memory of 904 1688 cmd.exe 34 PID 1688 wrote to memory of 904 1688 cmd.exe 34 PID 1688 wrote to memory of 904 1688 cmd.exe 34 PID 1688 wrote to memory of 904 1688 cmd.exe 34 PID 1632 wrote to memory of 908 1632 cmd.exe 35 PID 1632 wrote to memory of 908 1632 cmd.exe 35 PID 1632 wrote to memory of 908 1632 cmd.exe 35 PID 1632 wrote to memory of 908 1632 cmd.exe 35 PID 1320 wrote to memory of 336 1320 cmd.exe 36 PID 1320 wrote to memory of 336 1320 cmd.exe 36 PID 1320 wrote to memory of 336 1320 cmd.exe 36 PID 1320 wrote to memory of 336 1320 cmd.exe 36 PID 1524 wrote to memory of 2012 1524 cmd.exe 37 PID 1524 wrote to memory of 2012 1524 cmd.exe 37 PID 1524 wrote to memory of 2012 1524 cmd.exe 37 PID 1524 wrote to memory of 2012 1524 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe"C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:336
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2012
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\NV00V6M540.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\NV00V6M540.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\NV00V6M540.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\NV00V6M540.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:908
-
-