Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    42s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 16:27 UTC

General

  • Target

    fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe

  • Size

    46KB

  • MD5

    09dc0c40e288bc6f914b4915e3cc6910

  • SHA1

    0119ee3a7345f7c0566fe0ec55d41f3d4c58228e

  • SHA256

    fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e

  • SHA512

    d1960cf2314083d599acb52c76f94bd7fce5e6117c5dbf01d8f0f9ca42fcc78fb66932dee703f245941741de0dd538373e8d1dd4b46793c2c0fc714a4fb54487

  • SSDEEP

    768:BJzJB5Komz8DdPaDfijlSqnHPk1kz8+Xk62nvodahZGvDHSOXqS:BJFBTmDriTn8SwMkXodJN/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 32 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:476
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:460
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
          2⤵
            PID:736
          • C:\Windows\System32\spoolsv.exe
            C:\Windows\System32\spoolsv.exe
            2⤵
              PID:928
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
              2⤵
                PID:956
              • C:\Windows\system32\sppsvc.exe
                C:\Windows\system32\sppsvc.exe
                2⤵
                  PID:1100
                • C:\Windows\system32\taskhost.exe
                  "taskhost.exe"
                  2⤵
                    PID:1128
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                    2⤵
                      PID:1048
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k NetworkService
                      2⤵
                        PID:340
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs
                        2⤵
                          PID:864
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService
                          2⤵
                            PID:840
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                            2⤵
                              PID:796
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k RPCSS
                              2⤵
                                PID:656
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k DcomLaunch
                                2⤵
                                  PID:580
                              • C:\Windows\system32\winlogon.exe
                                winlogon.exe
                                1⤵
                                  PID:416
                                • C:\Windows\system32\csrss.exe
                                  %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                  1⤵
                                    PID:380
                                    • C:\Windows\system32\conhost.exe
                                      \??\C:\Windows\system32\conhost.exe "-8864392381396318077-645945528-1939301066-1949555070612896913-1635879234-620616008"
                                      2⤵
                                        PID:1968
                                    • C:\Windows\system32\wininit.exe
                                      wininit.exe
                                      1⤵
                                        PID:368
                                        • C:\Windows\system32\lsm.exe
                                          C:\Windows\system32\lsm.exe
                                          2⤵
                                            PID:484
                                        • C:\Windows\Explorer.EXE
                                          C:\Windows\Explorer.EXE
                                          1⤵
                                            PID:1268
                                            • C:\Users\Admin\AppData\Local\Temp\fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe
                                              "C:\Users\Admin\AppData\Local\Temp\fe74af12204ebfb9d2078547c683bd16722acb5ca6fcb6f1106027e0fee4d28e.exe"
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: MapViewOfSection
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:1976
                                          • C:\Windows\system32\wbem\wmiprvse.exe
                                            C:\Windows\system32\wbem\wmiprvse.exe
                                            1⤵
                                              PID:1980
                                            • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                                              wmiadap.exe /F /T /R
                                              1⤵
                                                PID:1952
                                              • C:\Windows\system32\Dwm.exe
                                                "C:\Windows\system32\Dwm.exe"
                                                1⤵
                                                  PID:1192
                                                • C:\Windows\system32\winlogon.exe
                                                  winlogon.exe
                                                  1⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:1104
                                                  • C:\Windows\system32\LogonUI.exe
                                                    "LogonUI.exe" /flags:0x0
                                                    2⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2032
                                                • C:\Windows\system32\csrss.exe
                                                  %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                  1⤵
                                                  • Enumerates system info in registry
                                                  PID:1360

                                                Network

                                                MITRE ATT&CK Enterprise v6

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • memory/1976-54-0x0000000001000000-0x0000000001010000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/2032-56-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

                                                  Filesize

                                                  8KB

                                                We care about your privacy.

                                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.