Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 21:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe
-
Size
747KB
-
MD5
0dc609e6156e018c3622756da40dd058
-
SHA1
dcbd22be25a317e7004b83cb34d5f55cb2bbc9c8
-
SHA256
df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a
-
SHA512
bc1cd270317bdaa2e4854dcec19e3653b5741c0bf48b20911197fd48aff7b2077e1951d6f5dad2e8bbc844569497e3f7f11f8b184581c67100bcc0b98951a7d5
-
SSDEEP
6144:Epqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcXYnCH:EpqiC/2OGAtkCP4cejGSOpRKACnIi
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\i: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\u: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\t: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\w: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\e: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\f: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\k: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\o: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\q: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\r: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\v: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\x: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\j: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\l: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\m: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\n: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\y: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\s: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\z: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\a: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\b: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\g: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\p: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/720-132-0x0000000000400000-0x00000000004D8000-memory.dmp autoit_exe behavioral2/memory/720-139-0x0000000000400000-0x00000000004D8000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\autorun.inf df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 720 wrote to memory of 4932 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 81 PID 720 wrote to memory of 4932 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 81 PID 720 wrote to memory of 4932 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 81 PID 4932 wrote to memory of 4892 4932 cmd.exe 83 PID 4932 wrote to memory of 4892 4932 cmd.exe 83 PID 4932 wrote to memory of 4892 4932 cmd.exe 83 PID 720 wrote to memory of 4632 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 85 PID 720 wrote to memory of 4632 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 85 PID 720 wrote to memory of 4632 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 85 PID 4632 wrote to memory of 5088 4632 cmd.exe 87 PID 4632 wrote to memory of 5088 4632 cmd.exe 87 PID 4632 wrote to memory of 5088 4632 cmd.exe 87 PID 720 wrote to memory of 1372 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 88 PID 720 wrote to memory of 1372 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 88 PID 720 wrote to memory of 1372 720 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 88 PID 1372 wrote to memory of 3176 1372 cmd.exe 90 PID 1372 wrote to memory of 3176 1372 cmd.exe 90 PID 1372 wrote to memory of 3176 1372 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe"C:\Users\Admin\AppData\Local\Temp\df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:4892
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe3⤵PID:5088
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:3176
-
-