Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 23:13
Static task
static1
Behavioral task
behavioral1
Sample
8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe
Resource
win10v2004-20220812-en
General
-
Target
8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe
-
Size
44KB
-
MD5
03fa1eb2c8ed7bcdff4d18a7c54ec9a0
-
SHA1
0f3d49bdf6d38d57f97799bff106a65a14acf29d
-
SHA256
8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a
-
SHA512
14b207810325049c286db326ba2cabd2b94f28217bd5a8bc3dddae00f01c52e24eb87416d7743dd44a941564ddb946a0ef2c5f4fa9ed36814096bef462a0787f
-
SSDEEP
768:xwSusJflkizHZN/XS8yxxD+hAckJ1jv/R7a55vGFdBTzHINxmsG:dJWE3C8yfD2AckJx39ajeloNxm
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\beep.sys 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe File created C:\Windows\SysWOW64\drivers\beep.sys regedit32.exe -
Executes dropped EXE 1 IoCs
pid Process 1676 regedit32.exe -
Deletes itself 1 IoCs
pid Process 1360 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1976 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe 1976 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit32.exe 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe File created C:\Windows\SysWOW64\regedit32.exe regedit32.exe File created C:\Windows\SysWOW64\regedit32.exe 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 464 Process not Found 464 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1976 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe Token: SeIncBasePriorityPrivilege 1676 regedit32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1676 1976 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe 28 PID 1976 wrote to memory of 1676 1976 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe 28 PID 1976 wrote to memory of 1676 1976 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe 28 PID 1976 wrote to memory of 1676 1976 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe 28 PID 1976 wrote to memory of 1360 1976 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe 29 PID 1976 wrote to memory of 1360 1976 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe 29 PID 1976 wrote to memory of 1360 1976 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe 29 PID 1976 wrote to memory of 1360 1976 8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe 29 PID 1676 wrote to memory of 1756 1676 regedit32.exe 30 PID 1676 wrote to memory of 1756 1676 regedit32.exe 30 PID 1676 wrote to memory of 1756 1676 regedit32.exe 30 PID 1676 wrote to memory of 1756 1676 regedit32.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe"C:\Users\Admin\AppData\Local\Temp\8125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\regedit32.exe"C:\Windows\system32\regedit32.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\REGEDI~1.EXE > nul3⤵PID:1756
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\8125BF~1.EXE > nul2⤵
- Deletes itself
PID:1360
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD50e1d8c703b0b083560b95cd93b45c146
SHA1a1cb6b878445a2417ddd35d927255432eb5074e2
SHA256d0130627ab480faff1d9a67856f074c1232c7b19ff25dc951c18bb0afdde482b
SHA512ad0e0dbb4dd7cd9783dda6d91fc2be3d1c8091abdf27f3abb2a0325e1e10de0a452f11090ceb016c303c60b77ad4cf9c52ba74ba72f875f9c3ba565934bdcfde
-
Filesize
44KB
MD503fa1eb2c8ed7bcdff4d18a7c54ec9a0
SHA10f3d49bdf6d38d57f97799bff106a65a14acf29d
SHA2568125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a
SHA51214b207810325049c286db326ba2cabd2b94f28217bd5a8bc3dddae00f01c52e24eb87416d7743dd44a941564ddb946a0ef2c5f4fa9ed36814096bef462a0787f
-
Filesize
44KB
MD503fa1eb2c8ed7bcdff4d18a7c54ec9a0
SHA10f3d49bdf6d38d57f97799bff106a65a14acf29d
SHA2568125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a
SHA51214b207810325049c286db326ba2cabd2b94f28217bd5a8bc3dddae00f01c52e24eb87416d7743dd44a941564ddb946a0ef2c5f4fa9ed36814096bef462a0787f
-
Filesize
44KB
MD503fa1eb2c8ed7bcdff4d18a7c54ec9a0
SHA10f3d49bdf6d38d57f97799bff106a65a14acf29d
SHA2568125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a
SHA51214b207810325049c286db326ba2cabd2b94f28217bd5a8bc3dddae00f01c52e24eb87416d7743dd44a941564ddb946a0ef2c5f4fa9ed36814096bef462a0787f
-
Filesize
44KB
MD503fa1eb2c8ed7bcdff4d18a7c54ec9a0
SHA10f3d49bdf6d38d57f97799bff106a65a14acf29d
SHA2568125bf3a66e4229d2c1f338fbb22ef905399eef6a9b810ab127df2657fe3d72a
SHA51214b207810325049c286db326ba2cabd2b94f28217bd5a8bc3dddae00f01c52e24eb87416d7743dd44a941564ddb946a0ef2c5f4fa9ed36814096bef462a0787f