Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 12:03
Static task
static1
Behavioral task
behavioral1
Sample
438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe
Resource
win10v2004-20220812-en
General
-
Target
438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe
-
Size
176KB
-
MD5
083842ada9573818eb34522949d44c18
-
SHA1
db9940e0ff5eb8a687d80c48b067a7da1b80df3f
-
SHA256
438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc
-
SHA512
bcf22a4db08be55c8c886ff9053cf6dcea7c318f71132bf8e58fd3dbc11901e29e00a5dc0e9c6ef67c616789622522082dc5619b226e4a02314e46f48ce6c0f2
-
SSDEEP
3072:AoFvujbjlMi1RTGCA/bziy9tvzhir77uyeTZPh6GHYJsaM7d0:FFvuvjlM4T6bziyjvzMdethd4JZMp0
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1764 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce 438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\erhqqbioks = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe\"" 438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe -
Kills process with taskkill 1 IoCs
pid Process 1800 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1152 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1800 taskkill.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1764 2024 438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe 29 PID 2024 wrote to memory of 1764 2024 438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe 29 PID 2024 wrote to memory of 1764 2024 438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe 29 PID 2024 wrote to memory of 1764 2024 438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe 29 PID 2024 wrote to memory of 1764 2024 438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe 29 PID 2024 wrote to memory of 1764 2024 438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe 29 PID 2024 wrote to memory of 1764 2024 438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe 29 PID 1764 wrote to memory of 1800 1764 cmd.exe 31 PID 1764 wrote to memory of 1800 1764 cmd.exe 31 PID 1764 wrote to memory of 1800 1764 cmd.exe 31 PID 1764 wrote to memory of 1800 1764 cmd.exe 31 PID 1764 wrote to memory of 1800 1764 cmd.exe 31 PID 1764 wrote to memory of 1800 1764 cmd.exe 31 PID 1764 wrote to memory of 1800 1764 cmd.exe 31 PID 1764 wrote to memory of 1152 1764 cmd.exe 33 PID 1764 wrote to memory of 1152 1764 cmd.exe 33 PID 1764 wrote to memory of 1152 1764 cmd.exe 33 PID 1764 wrote to memory of 1152 1764 cmd.exe 33 PID 1764 wrote to memory of 1152 1764 cmd.exe 33 PID 1764 wrote to memory of 1152 1764 cmd.exe 33 PID 1764 wrote to memory of 1152 1764 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe"C:\Users\Admin\AppData\Local\Temp\438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /pid 2024 & for /l %x in (1,1,60) do ping 127.0.0.1 -n 2 -w 500 & del /q /f "C:\Users\Admin\AppData\Local\Temp\438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe" & if not exist "C:\Users\Admin\AppData\Local\Temp\438de44abdd1a89fbdd49cb37aa128f0cb4bc951eca89b850bd6d31f545571dc.exe" exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 20243⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 2 -w 5003⤵
- Runs ping.exe
PID:1152
-
-