Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2022, 18:40
Behavioral task
behavioral1
Sample
60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe
-
Size
982KB
-
MD5
0aabff5cd0ca1dff69845e6072b8bf50
-
SHA1
7c32cbe09edc59bf6a775985a4d5c9a0a0e789fb
-
SHA256
60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41
-
SHA512
d8b4e56f4e4d9da54d869a5baec77f823915a706921c80c09ae7ecfb0f027db4cee049b2c45d341b4b755b9c91f17a914aecb0d255b1100f1d567db61af0b13b
-
SSDEEP
12288:WSNC80I+cR3R03VseuO85F0I+cR3R03VseuO85:W4ChZcRi3VsesmZcRi3Vses
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe gphone.exe" 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral2/memory/4092-132-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/4092-137-0x0000000000400000-0x00000000004C1000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\gphone.exe" 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\l: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\o: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\u: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\z: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\b: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\g: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\s: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\x: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\r: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\a: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\f: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\j: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\k: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\n: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\t: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\v: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\w: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\e: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\i: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\m: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\p: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\q: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened (read-only) \??\y: 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4092-132-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral2/memory/4092-137-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\autorun.inf 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\autorun.ini 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File created C:\Windows\SysWOW64\gphone.exe 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened for modification C:\Windows\SysWOW64\gphone.exe 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\gphone.exe 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe File opened for modification C:\Windows\gphone.exe 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://rnd009.googlepages.com/google.html" 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://rnd009.googlepages.com/google.html" 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://rnd009.googlepages.com/google.html" 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://rnd009.googlepages.com/google.html" 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://rnd009.googlepages.com/google.html" 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4092 wrote to memory of 4312 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 85 PID 4092 wrote to memory of 4312 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 85 PID 4092 wrote to memory of 4312 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 85 PID 4312 wrote to memory of 1468 4312 cmd.exe 87 PID 4312 wrote to memory of 1468 4312 cmd.exe 87 PID 4312 wrote to memory of 1468 4312 cmd.exe 87 PID 4092 wrote to memory of 3564 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 88 PID 4092 wrote to memory of 3564 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 88 PID 4092 wrote to memory of 3564 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 88 PID 3564 wrote to memory of 5056 3564 cmd.exe 90 PID 3564 wrote to memory of 5056 3564 cmd.exe 90 PID 3564 wrote to memory of 5056 3564 cmd.exe 90 PID 4092 wrote to memory of 4120 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 91 PID 4092 wrote to memory of 4120 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 91 PID 4092 wrote to memory of 4120 4092 60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe 91 PID 4120 wrote to memory of 3656 4120 cmd.exe 93 PID 4120 wrote to memory of 3656 4120 cmd.exe 93 PID 4120 wrote to memory of 3656 4120 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe"C:\Users\Admin\AppData\Local\Temp\60aa2066ecab96a1a151b88c6b6908a9c34828292893ca41267df9cca6012b41.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:1468
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\gphone.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\gphone.exe3⤵PID:5056
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:3656
-
-