Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 02:06
Static task
static1
Behavioral task
behavioral1
Sample
3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe
-
Size
420KB
-
MD5
7d1b53499cad529cc9d7802629c2e910
-
SHA1
d96db968e5f75410563e4f6600dab4ebbd6792ba
-
SHA256
3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096
-
SHA512
4c8e96c1bdb1bf897cb771a8c18e9a62cea7fd71ff305a2f8855959d15bff53019561409bdb88149676266a32aef41cfed4f95bf4d54caca923a941106775f35
-
SSDEEP
6144:zK3HTNGVvHI2zBHng5HaVsbZgRnyR4mULJhkHM6jI7H1D7puVSC:23HcVvo21ga0aQ4HLJhkHM6jI7VD7wf
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\NV00V6M540.exe = "C:\\Users\\Admin\\AppData\\Roaming\\NV00V6M540.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 3596 reg.exe 3652 reg.exe 3740 reg.exe 2896 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeCreateTokenPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeAssignPrimaryTokenPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeLockMemoryPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeIncreaseQuotaPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeMachineAccountPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeTcbPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeSecurityPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeTakeOwnershipPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeLoadDriverPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeSystemProfilePrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeSystemtimePrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeProfSingleProcessPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeIncBasePriorityPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeCreatePagefilePrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeCreatePermanentPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeBackupPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeRestorePrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeShutdownPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeDebugPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeAuditPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeSystemEnvironmentPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeChangeNotifyPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeRemoteShutdownPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeUndockPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeSyncAgentPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeEnableDelegationPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeManageVolumePrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeImpersonatePrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeCreateGlobalPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: 31 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: 32 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: 33 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: 34 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: 35 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe Token: SeDebugPrivilege 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1152 wrote to memory of 3632 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 83 PID 1152 wrote to memory of 3632 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 83 PID 1152 wrote to memory of 3632 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 83 PID 1152 wrote to memory of 4276 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 84 PID 1152 wrote to memory of 4276 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 84 PID 1152 wrote to memory of 4276 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 84 PID 1152 wrote to memory of 1336 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 87 PID 1152 wrote to memory of 1336 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 87 PID 1152 wrote to memory of 1336 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 87 PID 1152 wrote to memory of 2288 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 89 PID 1152 wrote to memory of 2288 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 89 PID 1152 wrote to memory of 2288 1152 3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe 89 PID 1336 wrote to memory of 3740 1336 cmd.exe 93 PID 1336 wrote to memory of 3740 1336 cmd.exe 93 PID 1336 wrote to memory of 3740 1336 cmd.exe 93 PID 2288 wrote to memory of 3652 2288 cmd.exe 92 PID 2288 wrote to memory of 3652 2288 cmd.exe 92 PID 2288 wrote to memory of 3652 2288 cmd.exe 92 PID 3632 wrote to memory of 3596 3632 cmd.exe 91 PID 3632 wrote to memory of 3596 3632 cmd.exe 91 PID 3632 wrote to memory of 3596 3632 cmd.exe 91 PID 4276 wrote to memory of 2896 4276 cmd.exe 94 PID 4276 wrote to memory of 2896 4276 cmd.exe 94 PID 4276 wrote to memory of 2896 4276 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe"C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3596
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\3dc34eda159c03e42f9330b5b3cbc4e1f3814aa4671ca17fc0b3c9fc84b3b096.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2896
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3740
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\NV00V6M540.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\NV00V6M540.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\NV00V6M540.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\NV00V6M540.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3652
-
-