Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
Resource
win10v2004-20220812-en
General
-
Target
5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe
-
Size
124KB
-
MD5
923ed39defa9bc52ad0214d12e512e19
-
SHA1
630aa65f760175eb89688dd4c2945cb4034f79d0
-
SHA256
5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c
-
SHA512
6247a821450f73ebaeecfe9cf26f199017fc61bac638ecf63870a34281468a07c9e1c72c4daf8ea354a42f56fe10ff14fe0f21f62ade4216106e36d6cc1d2177
-
SSDEEP
1536:OXgcShcuUoTvNPLTVVIJQ95/5l/Cy+YPu4wJ0D:lUoBPLJVIJQT2RMuVJ0D
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\scssrr.exe" 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1168 set thread context of 1084 1168 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 27 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\scssrr.exe 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe File opened for modification C:\Windows\scssrr.exe 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1060 reg.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1168 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 1084 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1168 wrote to memory of 1084 1168 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 27 PID 1168 wrote to memory of 1084 1168 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 27 PID 1168 wrote to memory of 1084 1168 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 27 PID 1168 wrote to memory of 1084 1168 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 27 PID 1168 wrote to memory of 1084 1168 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 27 PID 1168 wrote to memory of 1084 1168 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 27 PID 1168 wrote to memory of 1084 1168 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 27 PID 1168 wrote to memory of 1084 1168 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 27 PID 1168 wrote to memory of 1084 1168 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 27 PID 1084 wrote to memory of 1724 1084 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 28 PID 1084 wrote to memory of 1724 1084 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 28 PID 1084 wrote to memory of 1724 1084 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 28 PID 1084 wrote to memory of 1724 1084 5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe 28 PID 1724 wrote to memory of 1060 1724 cmd.exe 30 PID 1724 wrote to memory of 1060 1724 cmd.exe 30 PID 1724 wrote to memory of 1060 1724 cmd.exe 30 PID 1724 wrote to memory of 1060 1724 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe"C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe"C:\Users\Admin\AppData\Local\Temp\5feb1573f82bbecfd38ad3a7540ca006995718063fb0ab5478771e294723e55c.exe"2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- Modifies registry key
PID:1060
-
-
-