Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 09:11
Static task
static1
Behavioral task
behavioral1
Sample
198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe
Resource
win10v2004-20220812-en
General
-
Target
198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe
-
Size
134KB
-
MD5
5354c99a734140e0241140cc8104d410
-
SHA1
21981e067eff6475ef73d802a6cb0b980af428ad
-
SHA256
198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17
-
SHA512
445368be64f8bb61aa106375c517a0e9973aa951de7bf376d9b98f7478ef5e996ad3e211421aef2f30c9af84c1bb709e1a39cc60d3f7c94c306a567fc183a713
-
SSDEEP
3072:9CUCBcRplEypnwe3EuwHH7F56Cn+hhgP4RN:xAQEy6e0uKggPe
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System Process not Found -
Modifies security service 2 TTPs 20 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn Process not Found Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security Process not Found -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\etadpug\ImagePath = "\"C:\\Program Files (x86)\\Google\\Desktop\\Install\\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\\ \\...\\\u202eﯹ๛\\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\\GoogleUpdate.exe\" <" 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe -
Deletes itself 1 IoCs
pid Process 1992 cmd.exe -
Unexpected DNS network traffic destination 11 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 Destination IP 85.114.128.127 -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Desktop\\Install\\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\\❤≸⋙\\Ⱒ☠⍨\\\u202eﯹ๛\\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\\GoogleUpdate.exe\" >" 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini Process not Found File created \systemroot\assembly\GAC_32\Desktop.ini Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 904 set thread context of 1992 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe 27 -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\es-ES:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\fr-FR:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpClient.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpCommu.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpRTP.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\ \...\ﯹ๛\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\@\:@ Process not Found File opened for modification C:\Program Files\Windows Defender\MpOAV.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\ \...\ﯹ๛\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\@ Process not Found File opened for modification C:\Program Files\Windows Defender\de-DE:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\ja-JP:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpAsDesc.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpEvMsg.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File created C:\Program Files (x86)\Google\Desktop\Install\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\ \...\ﯹ๛\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\@ 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\en-US:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\it-IT:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MsMpRes.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File created C:\Program Files (x86)\Google\Desktop\Install\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\ \...\ﯹ๛\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\GoogleUpdate.exe 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe -
NTFS ADS 19 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\MpAsDesc.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\fr-FR:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpEvMsg.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MsMpCom.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MsMpLics.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\en-US:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\es-ES:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpClient.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpCommu.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpSvc.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MsMpRes.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files (x86)\Google\Desktop\Install\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\ \...\ﯹ๛\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\@\:@ Process not Found File opened for modification C:\Program Files\Windows Defender\de-DE:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\it-IT:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\ja-JP:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpOAV.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe File opened for modification C:\Program Files\Windows Defender\MpRTP.dll:! 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe 464 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeRestorePrivilege 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe Token: SeDebugPrivilege 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe Token: SeDebugPrivilege 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe Token: SeRestorePrivilege 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe Token: SeBackupPrivilege 464 Process not Found Token: SeRestorePrivilege 464 Process not Found Token: SeSecurityPrivilege 464 Process not Found Token: SeTakeOwnershipPrivilege 464 Process not Found Token: SeBackupPrivilege 464 Process not Found Token: SeRestorePrivilege 464 Process not Found Token: SeSecurityPrivilege 464 Process not Found Token: SeTakeOwnershipPrivilege 464 Process not Found Token: SeBackupPrivilege 464 Process not Found Token: SeRestorePrivilege 464 Process not Found Token: SeSecurityPrivilege 464 Process not Found Token: SeTakeOwnershipPrivilege 464 Process not Found Token: SeBackupPrivilege 464 Process not Found Token: SeRestorePrivilege 464 Process not Found Token: SeSecurityPrivilege 464 Process not Found Token: SeTakeOwnershipPrivilege 464 Process not Found Token: SeBackupPrivilege 464 Process not Found Token: SeRestorePrivilege 464 Process not Found Token: SeSecurityPrivilege 464 Process not Found Token: SeTakeOwnershipPrivilege 464 Process not Found Token: SeBackupPrivilege 464 Process not Found Token: SeRestorePrivilege 464 Process not Found Token: SeSecurityPrivilege 464 Process not Found Token: SeTakeOwnershipPrivilege 464 Process not Found Token: SeBackupPrivilege 464 Process not Found Token: SeRestorePrivilege 464 Process not Found Token: SeSecurityPrivilege 464 Process not Found Token: SeTakeOwnershipPrivilege 464 Process not Found Token: SeBackupPrivilege 464 Process not Found Token: SeRestorePrivilege 464 Process not Found Token: SeSecurityPrivilege 464 Process not Found Token: SeTakeOwnershipPrivilege 464 Process not Found Token: SeDebugPrivilege 464 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1244 Process not Found 1244 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1244 Process not Found 1244 Process not Found -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 904 wrote to memory of 1992 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe 27 PID 904 wrote to memory of 1992 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe 27 PID 904 wrote to memory of 1992 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe 27 PID 904 wrote to memory of 1992 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe 27 PID 904 wrote to memory of 1992 904 198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe"C:\Users\Admin\AppData\Local\Temp\198415190cae0632e65bb27b4af3948ddd2b34454896ddd97ccc46404bdcbd17.exe"1⤵
- Modifies security service
- Sets service image path in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
PID:1992
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Desktop\Install\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\ \...\ﯹ๛\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\@
Filesize2KB
MD5445acda0bb7363a0c6094a62612b2337
SHA1f48aec1cf6895246acce6bc1bbc502c7f95661d7
SHA2560e599b1396dc5953bdf0cdb8a85841ec270b8074d1273b806f47fe1515d001a6
SHA5129f4e7bf46fa8787152c8f4995d548fafb75bdac2acae5941483ac8cdabbaa5e0e2d84ca5313dcf6646dd2b3ebd497aa6b757293fd51e1ed03b786f81f3d410e3