Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    21/10/2022, 02:56

General

  • Target

    6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c.exe

  • Size

    456KB

  • MD5

    53c4f7882517eabc78d3ee22d897aa4e

  • SHA1

    c59e5a5b286eb15c22f1cf0975b11652f97c5ba9

  • SHA256

    6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c

  • SHA512

    47bef082df3e812f7e54e9b3236c915ffe093a679ae41c54946fe795e97489a027c38d1dc7a92ac18b86cbc2419fb5866b5e25dd17c47d90385996996bd78be5

  • SSDEEP

    12288:jEVXKpmokkif4JgTIoq43H2cE05nMx11DGkfb7i:jEtR8iAJgMe3H2cJCx1YOb7i

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 48 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c.exe
    "C:\Users\Admin\AppData\Local\Temp\6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Users\Admin\AppData\Local\Temp\6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c.exe
      6a259d9835e29b5dcead72762b3bbcbf587ed698c6d64cea6b0760554183e59c.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe
        C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1236
        • C:\Users\Admin\vooek.exe
          "C:\Users\Admin\vooek.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:664
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del iAsD8zgo9sJlU4T4lK.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1716
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1880
      • C:\Users\Admin\txhost.exe
        C:\Users\Admin\txhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:956
        • C:\Users\Admin\txhost.exe
          txhost.exe
          4⤵
          • Executes dropped EXE
          PID:2016
      • C:\Users\Admin\uxhost.exe
        C:\Users\Admin\uxhost.exe
        3⤵
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of AdjustPrivilegeToken
        PID:1492
      • C:\Users\Admin\vxhost.exe
        C:\Users\Admin\vxhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:812

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe

    Filesize

    156KB

    MD5

    c1ca4a842399156d6ce56df9fe167158

    SHA1

    c24482b800d11e8f0238df3d950b745f38c245e7

    SHA256

    197d8be66fca12a1c137e920a49610b38f29756c7b7473ec1962c6499918f15a

    SHA512

    a89f3170db1de6f296b12c42059495821ef6e9b03a8e3e58aafcfa5cfab8cc0f996e5498476f638a80f604a2c2d6b7d626bd621b35b0c4502b6916aa1380e1c9

  • C:\Users\Admin\iAsD8zgo9sJlU4T4lK.exe

    Filesize

    156KB

    MD5

    c1ca4a842399156d6ce56df9fe167158

    SHA1

    c24482b800d11e8f0238df3d950b745f38c245e7

    SHA256

    197d8be66fca12a1c137e920a49610b38f29756c7b7473ec1962c6499918f15a

    SHA512

    a89f3170db1de6f296b12c42059495821ef6e9b03a8e3e58aafcfa5cfab8cc0f996e5498476f638a80f604a2c2d6b7d626bd621b35b0c4502b6916aa1380e1c9

  • C:\Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • C:\Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • C:\Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • C:\Users\Admin\uxhost.exe

    Filesize

    219KB

    MD5

    861e3902ecc188eba323032a88d1e56e

    SHA1

    6c6265be666d9c93acd6ddc55e94a9de8580191c

    SHA256

    79ae1f344b550f57a9f03ec18894df1b9b255b865b5872801d0f043c1b77eb84

    SHA512

    044f284dd78b7aad2f733628c901d7bd1067436d76c4b3fad3bf024f8faecaaf38e453053431daf7afa8c8b14f5eea6fe4f75148b8923ac2441f966ac118cec4

  • C:\Users\Admin\uxhost.exe

    Filesize

    219KB

    MD5

    861e3902ecc188eba323032a88d1e56e

    SHA1

    6c6265be666d9c93acd6ddc55e94a9de8580191c

    SHA256

    79ae1f344b550f57a9f03ec18894df1b9b255b865b5872801d0f043c1b77eb84

    SHA512

    044f284dd78b7aad2f733628c901d7bd1067436d76c4b3fad3bf024f8faecaaf38e453053431daf7afa8c8b14f5eea6fe4f75148b8923ac2441f966ac118cec4

  • C:\Users\Admin\vooek.exe

    Filesize

    156KB

    MD5

    04dcda3ebfea349586c4f73261e7f700

    SHA1

    279a09add76872c6ada5d1c16c6a469b451e7de9

    SHA256

    05d86efc132005426c13f32b5f0024dcb422baa3d75d788c837ecdf3bfd5a696

    SHA512

    9a9144159dc612bdc1f37ee86f5634e616d07809f19656e04703959d6884479840be5557bb5b3bc770d1b77916db9df61c91a12d5858cf9a2292a1b10e1f2859

  • C:\Users\Admin\vooek.exe

    Filesize

    156KB

    MD5

    04dcda3ebfea349586c4f73261e7f700

    SHA1

    279a09add76872c6ada5d1c16c6a469b451e7de9

    SHA256

    05d86efc132005426c13f32b5f0024dcb422baa3d75d788c837ecdf3bfd5a696

    SHA512

    9a9144159dc612bdc1f37ee86f5634e616d07809f19656e04703959d6884479840be5557bb5b3bc770d1b77916db9df61c91a12d5858cf9a2292a1b10e1f2859

  • C:\Users\Admin\vxhost.exe

    Filesize

    24KB

    MD5

    83521374a9132135d3bb5f44edf87b0c

    SHA1

    8c32ff99d92310b0fe3e618453d929fa9cf15ef2

    SHA256

    4942626858e7a1ea7a2c543f2207eb5bbae4715e328d7b0f2afc396be042c80a

    SHA512

    9ea2599188401d984e71008dcf942bdb47c77c90b157b5ee5387ffb716e14529920aedbf3251d7f20ff69ee7fc5e9955626522abdc2ae6c9391a6ada7478ce7c

  • \Users\Admin\iAsD8zgo9sJlU4T4lK.exe

    Filesize

    156KB

    MD5

    c1ca4a842399156d6ce56df9fe167158

    SHA1

    c24482b800d11e8f0238df3d950b745f38c245e7

    SHA256

    197d8be66fca12a1c137e920a49610b38f29756c7b7473ec1962c6499918f15a

    SHA512

    a89f3170db1de6f296b12c42059495821ef6e9b03a8e3e58aafcfa5cfab8cc0f996e5498476f638a80f604a2c2d6b7d626bd621b35b0c4502b6916aa1380e1c9

  • \Users\Admin\iAsD8zgo9sJlU4T4lK.exe

    Filesize

    156KB

    MD5

    c1ca4a842399156d6ce56df9fe167158

    SHA1

    c24482b800d11e8f0238df3d950b745f38c245e7

    SHA256

    197d8be66fca12a1c137e920a49610b38f29756c7b7473ec1962c6499918f15a

    SHA512

    a89f3170db1de6f296b12c42059495821ef6e9b03a8e3e58aafcfa5cfab8cc0f996e5498476f638a80f604a2c2d6b7d626bd621b35b0c4502b6916aa1380e1c9

  • \Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • \Users\Admin\txhost.exe

    Filesize

    146KB

    MD5

    18c83c689100e66caedb1c76ed87bd95

    SHA1

    901c0f6c4757d37d5a2e357704344aeb31a9cadb

    SHA256

    37d78483538af016b7646678df08893badea86d7b5f4317b99393bbcd3c172b9

    SHA512

    e87c6aeaa1cc7a69f390c57d4cbcc1efa3cb5349a445831f822f7843b3a3d850f9793818d4e1e7fe011a5af0e99bbdb7cf8a5ec13541dedb8431fc47ef9f33b1

  • \Users\Admin\uxhost.exe

    Filesize

    219KB

    MD5

    861e3902ecc188eba323032a88d1e56e

    SHA1

    6c6265be666d9c93acd6ddc55e94a9de8580191c

    SHA256

    79ae1f344b550f57a9f03ec18894df1b9b255b865b5872801d0f043c1b77eb84

    SHA512

    044f284dd78b7aad2f733628c901d7bd1067436d76c4b3fad3bf024f8faecaaf38e453053431daf7afa8c8b14f5eea6fe4f75148b8923ac2441f966ac118cec4

  • \Users\Admin\uxhost.exe

    Filesize

    219KB

    MD5

    861e3902ecc188eba323032a88d1e56e

    SHA1

    6c6265be666d9c93acd6ddc55e94a9de8580191c

    SHA256

    79ae1f344b550f57a9f03ec18894df1b9b255b865b5872801d0f043c1b77eb84

    SHA512

    044f284dd78b7aad2f733628c901d7bd1067436d76c4b3fad3bf024f8faecaaf38e453053431daf7afa8c8b14f5eea6fe4f75148b8923ac2441f966ac118cec4

  • \Users\Admin\vooek.exe

    Filesize

    156KB

    MD5

    04dcda3ebfea349586c4f73261e7f700

    SHA1

    279a09add76872c6ada5d1c16c6a469b451e7de9

    SHA256

    05d86efc132005426c13f32b5f0024dcb422baa3d75d788c837ecdf3bfd5a696

    SHA512

    9a9144159dc612bdc1f37ee86f5634e616d07809f19656e04703959d6884479840be5557bb5b3bc770d1b77916db9df61c91a12d5858cf9a2292a1b10e1f2859

  • \Users\Admin\vooek.exe

    Filesize

    156KB

    MD5

    04dcda3ebfea349586c4f73261e7f700

    SHA1

    279a09add76872c6ada5d1c16c6a469b451e7de9

    SHA256

    05d86efc132005426c13f32b5f0024dcb422baa3d75d788c837ecdf3bfd5a696

    SHA512

    9a9144159dc612bdc1f37ee86f5634e616d07809f19656e04703959d6884479840be5557bb5b3bc770d1b77916db9df61c91a12d5858cf9a2292a1b10e1f2859

  • \Users\Admin\vxhost.exe

    Filesize

    24KB

    MD5

    83521374a9132135d3bb5f44edf87b0c

    SHA1

    8c32ff99d92310b0fe3e618453d929fa9cf15ef2

    SHA256

    4942626858e7a1ea7a2c543f2207eb5bbae4715e328d7b0f2afc396be042c80a

    SHA512

    9ea2599188401d984e71008dcf942bdb47c77c90b157b5ee5387ffb716e14529920aedbf3251d7f20ff69ee7fc5e9955626522abdc2ae6c9391a6ada7478ce7c

  • \Users\Admin\vxhost.exe

    Filesize

    24KB

    MD5

    83521374a9132135d3bb5f44edf87b0c

    SHA1

    8c32ff99d92310b0fe3e618453d929fa9cf15ef2

    SHA256

    4942626858e7a1ea7a2c543f2207eb5bbae4715e328d7b0f2afc396be042c80a

    SHA512

    9ea2599188401d984e71008dcf942bdb47c77c90b157b5ee5387ffb716e14529920aedbf3251d7f20ff69ee7fc5e9955626522abdc2ae6c9391a6ada7478ce7c

  • memory/1284-68-0x0000000075931000-0x0000000075933000-memory.dmp

    Filesize

    8KB

  • memory/1284-94-0x0000000001D20000-0x0000000001D84000-memory.dmp

    Filesize

    400KB

  • memory/1284-65-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/1284-54-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/1284-62-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/1284-55-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/1284-57-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

  • memory/1492-99-0x0000000000220000-0x0000000000284000-memory.dmp

    Filesize

    400KB

  • memory/1492-98-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/1492-97-0x0000000000220000-0x0000000000284000-memory.dmp

    Filesize

    400KB

  • memory/2016-101-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2016-112-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2016-116-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2016-110-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2016-108-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2016-106-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2016-104-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2016-102-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB