Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
osn.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
osn.exe
Resource
win10v2004-20220812-en
General
-
Target
osn.exe
-
Size
426KB
-
MD5
7990a08facbe1c8c5a673aee28de308a
-
SHA1
940bf5f40d0dd3b47b732d66d9bfae33e01d5d0f
-
SHA256
5aabccffcd5fe39c601e91a3c84f24854ce3aacc07321c1a09054942ab7aaa41
-
SHA512
8598137aa03f6c5ef48b5d370e9ba0d51386660c9de00c9ec051710adae204e150b259a31adde2f1d64dc1bf94707d515629992dc62020a5db8fd1721450336d
-
SSDEEP
6144:yZDNxWGx7Dsgz5Z7aZgYvhzmi7UDXTKFtwIjH1VdRQ/vqkg1gEagdQH:zG7DZJaZgIhzmmUTKFTj1V7uikFg
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 964 google.exe 1904 google.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 696 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7787bd67a92b047a61177111148878bc.exe google.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7787bd67a92b047a61177111148878bc.exe google.exe -
Loads dropped DLL 1 IoCs
pid Process 1724 osn.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\7787bd67a92b047a61177111148878bc = "\"C:\\ProgramData\\google.exe\" .." google.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\7787bd67a92b047a61177111148878bc = "\"C:\\ProgramData\\google.exe\" .." google.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1952 set thread context of 1724 1952 osn.exe 28 PID 964 set thread context of 1904 964 google.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1904 google.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1952 osn.exe Token: SeDebugPrivilege 964 google.exe Token: SeDebugPrivilege 1904 google.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1952 wrote to memory of 1724 1952 osn.exe 28 PID 1952 wrote to memory of 1724 1952 osn.exe 28 PID 1952 wrote to memory of 1724 1952 osn.exe 28 PID 1952 wrote to memory of 1724 1952 osn.exe 28 PID 1952 wrote to memory of 1724 1952 osn.exe 28 PID 1952 wrote to memory of 1724 1952 osn.exe 28 PID 1952 wrote to memory of 1724 1952 osn.exe 28 PID 1952 wrote to memory of 1724 1952 osn.exe 28 PID 1952 wrote to memory of 1724 1952 osn.exe 28 PID 1724 wrote to memory of 964 1724 osn.exe 29 PID 1724 wrote to memory of 964 1724 osn.exe 29 PID 1724 wrote to memory of 964 1724 osn.exe 29 PID 1724 wrote to memory of 964 1724 osn.exe 29 PID 964 wrote to memory of 1904 964 google.exe 30 PID 964 wrote to memory of 1904 964 google.exe 30 PID 964 wrote to memory of 1904 964 google.exe 30 PID 964 wrote to memory of 1904 964 google.exe 30 PID 964 wrote to memory of 1904 964 google.exe 30 PID 964 wrote to memory of 1904 964 google.exe 30 PID 964 wrote to memory of 1904 964 google.exe 30 PID 964 wrote to memory of 1904 964 google.exe 30 PID 964 wrote to memory of 1904 964 google.exe 30 PID 1904 wrote to memory of 696 1904 google.exe 31 PID 1904 wrote to memory of 696 1904 google.exe 31 PID 1904 wrote to memory of 696 1904 google.exe 31 PID 1904 wrote to memory of 696 1904 google.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\osn.exe"C:\Users\Admin\AppData\Local\Temp\osn.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\osn.exeC:\Users\Admin\AppData\Local\Temp\osn.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\ProgramData\google.exe"C:\ProgramData\google.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964 -
C:\ProgramData\google.exeC:\ProgramData\google.exe4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\ProgramData\google.exe" "google.exe" ENABLE5⤵
- Modifies Windows Firewall
PID:696
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
426KB
MD57990a08facbe1c8c5a673aee28de308a
SHA1940bf5f40d0dd3b47b732d66d9bfae33e01d5d0f
SHA2565aabccffcd5fe39c601e91a3c84f24854ce3aacc07321c1a09054942ab7aaa41
SHA5128598137aa03f6c5ef48b5d370e9ba0d51386660c9de00c9ec051710adae204e150b259a31adde2f1d64dc1bf94707d515629992dc62020a5db8fd1721450336d
-
Filesize
426KB
MD57990a08facbe1c8c5a673aee28de308a
SHA1940bf5f40d0dd3b47b732d66d9bfae33e01d5d0f
SHA2565aabccffcd5fe39c601e91a3c84f24854ce3aacc07321c1a09054942ab7aaa41
SHA5128598137aa03f6c5ef48b5d370e9ba0d51386660c9de00c9ec051710adae204e150b259a31adde2f1d64dc1bf94707d515629992dc62020a5db8fd1721450336d
-
Filesize
426KB
MD57990a08facbe1c8c5a673aee28de308a
SHA1940bf5f40d0dd3b47b732d66d9bfae33e01d5d0f
SHA2565aabccffcd5fe39c601e91a3c84f24854ce3aacc07321c1a09054942ab7aaa41
SHA5128598137aa03f6c5ef48b5d370e9ba0d51386660c9de00c9ec051710adae204e150b259a31adde2f1d64dc1bf94707d515629992dc62020a5db8fd1721450336d
-
Filesize
426KB
MD57990a08facbe1c8c5a673aee28de308a
SHA1940bf5f40d0dd3b47b732d66d9bfae33e01d5d0f
SHA2565aabccffcd5fe39c601e91a3c84f24854ce3aacc07321c1a09054942ab7aaa41
SHA5128598137aa03f6c5ef48b5d370e9ba0d51386660c9de00c9ec051710adae204e150b259a31adde2f1d64dc1bf94707d515629992dc62020a5db8fd1721450336d