Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 22:50
Static task
static1
Behavioral task
behavioral1
Sample
ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe
Resource
win10v2004-20220812-en
General
-
Target
ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe
-
Size
228KB
-
MD5
a2210286de69f28dcf7ac80a008b7b30
-
SHA1
2a52ecd31fd396034fc5b17652f36867ce4d1e4f
-
SHA256
ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2
-
SHA512
555c92df776c31ae2ddf8199944e0773f7d8e55f16a8c7622cc03870c6e0b7ae80350b8648ba0c347696fc06af426d1c30a362da86c19d35d263171820fc01e3
-
SSDEEP
6144:MvnR60RV2tZdSNVzNP6KkIR60RV2tZdSNVz:M5LVedwNd7LVedw
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x000500000000b2d2-56.dat aspack_v212_v242 behavioral1/files/0x000500000000b2d2-58.dat aspack_v212_v242 behavioral1/files/0x000900000001231c-60.dat aspack_v212_v242 behavioral1/files/0x000a000000012307-68.dat aspack_v212_v242 behavioral1/files/0x000a000000012307-69.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 856 53d538cc.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 53d538cc.exe -
resource yara_rule behavioral1/files/0x000500000000b2d2-56.dat upx behavioral1/files/0x000500000000b2d2-58.dat upx behavioral1/memory/856-59-0x0000000000D00000-0x0000000000D24000-memory.dmp upx behavioral1/files/0x000900000001231c-60.dat upx behavioral1/memory/856-65-0x0000000000D00000-0x0000000000D24000-memory.dmp upx behavioral1/files/0x000a000000012307-68.dat upx behavioral1/files/0x000a000000012307-69.dat upx behavioral1/memory/1100-71-0x0000000074EF0000-0x0000000074F14000-memory.dmp upx behavioral1/memory/1100-73-0x0000000074EF0000-0x0000000074F14000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 856 53d538cc.exe 1100 Svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\114B04A8.tmp 53d538cc.exe File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 53d538cc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1072 620 WerFault.exe 26 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 856 53d538cc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 620 wrote to memory of 856 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 27 PID 620 wrote to memory of 856 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 27 PID 620 wrote to memory of 856 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 27 PID 620 wrote to memory of 856 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 27 PID 620 wrote to memory of 856 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 27 PID 620 wrote to memory of 856 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 27 PID 620 wrote to memory of 856 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 27 PID 620 wrote to memory of 1072 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 29 PID 620 wrote to memory of 1072 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 29 PID 620 wrote to memory of 1072 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 29 PID 620 wrote to memory of 1072 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 29 PID 620 wrote to memory of 1072 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 29 PID 620 wrote to memory of 1072 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 29 PID 620 wrote to memory of 1072 620 ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe"C:\Users\Admin\AppData\Local\Temp\ec6db9498a042427a02922defd858f55e092de676b1e7f1ef90900168d14f8c2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\53d538cc.exeC:\53d538cc.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 2562⤵
- Program crash
PID:1072
-
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\SysWOW64\Svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:1100
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD59edd836f73a5aa1b844865a3b98814f9
SHA123ca95f159ddb968fb1c6f239f6d9fbcbc92efce
SHA25618d783fecdedc087596077e9cbb242ead86266a44fa362f8712af71bb6a20388
SHA512c2600d1cd2bb1c0f61fa1072694f6ccc0a8a182383911363b7333a82b42edf5e2999c3e4f0766fd345e0ff336b64c59f0b2a47d5736938ed3467f6b334e42731
-
Filesize
79KB
MD59edd836f73a5aa1b844865a3b98814f9
SHA123ca95f159ddb968fb1c6f239f6d9fbcbc92efce
SHA25618d783fecdedc087596077e9cbb242ead86266a44fa362f8712af71bb6a20388
SHA512c2600d1cd2bb1c0f61fa1072694f6ccc0a8a182383911363b7333a82b42edf5e2999c3e4f0766fd345e0ff336b64c59f0b2a47d5736938ed3467f6b334e42731
-
Filesize
720B
MD5f537b0175a36eee7ac99d1749baf9de5
SHA143b7fa96121c411a60c7b64a6be11d3d2e354bea
SHA256f82136c1baa8477f96cf13db95ced38c9a6b2adda812e84bf3a72b17ae79bd9a
SHA512c2a3bd4e5ba6feb6b3dc22c8d7a18b9464cfc2c4ff06e1b798e58fcdbd44ad0d00b0c060aa6047b41699600bbe3222b8de353ef6fe8b448d9a175c54397b36ae
-
Filesize
79KB
MD58428a8d94dca536c2d3533d87f48c164
SHA1d26e83a55bd507a35ab7a4d732160c24d68b56a3
SHA2560279bc6ad6f3f6f20266eabde3718c85aa3c80a3cd647f1bb05f2640ebfebdb9
SHA5120cd2f8465ff4222b22f791d71aa07b1ce97d9c430b2ae77de0de04f2aef42dd69545a90914c6a5c2bda4c775ee6523396dd4c49987b4dd9c2e4e98156a66fa35
-
Filesize
79KB
MD58428a8d94dca536c2d3533d87f48c164
SHA1d26e83a55bd507a35ab7a4d732160c24d68b56a3
SHA2560279bc6ad6f3f6f20266eabde3718c85aa3c80a3cd647f1bb05f2640ebfebdb9
SHA5120cd2f8465ff4222b22f791d71aa07b1ce97d9c430b2ae77de0de04f2aef42dd69545a90914c6a5c2bda4c775ee6523396dd4c49987b4dd9c2e4e98156a66fa35
-
Filesize
79KB
MD58428a8d94dca536c2d3533d87f48c164
SHA1d26e83a55bd507a35ab7a4d732160c24d68b56a3
SHA2560279bc6ad6f3f6f20266eabde3718c85aa3c80a3cd647f1bb05f2640ebfebdb9
SHA5120cd2f8465ff4222b22f791d71aa07b1ce97d9c430b2ae77de0de04f2aef42dd69545a90914c6a5c2bda4c775ee6523396dd4c49987b4dd9c2e4e98156a66fa35