Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 00:25
Static task
static1
Behavioral task
behavioral1
Sample
8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe
-
Size
376KB
-
MD5
0c45ce2d32347e94e4519d56161d017a
-
SHA1
a5b7826d1d9c1546b660a166c198ff7e1cd7750d
-
SHA256
8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5
-
SHA512
f886cf0bf9305e76fb0a6ec62db6bd081a03e9036569039985d1f85e56bd4a50a492d5bade13657f8bcdae1e7617d79ec02a84db8921a8399b863e61b00fbca9
-
SSDEEP
6144:eXTlaHARcl7WYR/6TB8qXTlaHARcl7WYR/6TB:ejlHS6TtjlHS6T
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 912 iexplore.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\defoj = "\"C:\\Users\\Admin\\AppData\\Roaming\\defoj.exe\" -autorun" iexplore.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe 912 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1768 8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1768 wrote to memory of 912 1768 8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe 27 PID 1768 wrote to memory of 912 1768 8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe 27 PID 1768 wrote to memory of 912 1768 8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe 27 PID 1768 wrote to memory of 912 1768 8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe 27 PID 1768 wrote to memory of 912 1768 8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe 27 PID 1768 wrote to memory of 912 1768 8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe 27 PID 912 wrote to memory of 1388 912 iexplore.exe 15
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe"C:\Users\Admin\AppData\Local\Temp\8a492dcfaead4c531d1d0be16dc2d74a4ee983149d43e70e8a8686888d4ae1e5.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Deletes itself
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:912
-
-