Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 06:19
Static task
static1
Behavioral task
behavioral1
Sample
ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe
-
Size
333KB
-
MD5
0dfdb2aff1563d36baa793fa209f6fd0
-
SHA1
36536b8ec6e76cc125a9f7d44dccabeba7fd9c4b
-
SHA256
ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd
-
SHA512
c7c3aa0ba753d6f86374d2b0b1c6e8115896a82c1273aaf991061100a10ab9f014d6568ca118723e161a6ab4e344d862d00f248c069e0c908085be4375376d24
-
SSDEEP
6144:3LObkszAhheFdgIkYofIa8SQcPqIpwGGIQ9aM5BDhm0gVpXANRXds3zgbJ5u0rMz:7AzAY0BhqIxGIq9ywjdIzgN4iMpt
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 940 ddsa.scr -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: 33 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe Token: SeIncBasePriorityPrivilege 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2004 DllHost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 940 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 28 PID 1932 wrote to memory of 940 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 28 PID 1932 wrote to memory of 940 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 28 PID 1932 wrote to memory of 940 1932 ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe"C:\Users\Admin\AppData\Local\Temp\ee82de494114997bd1eae2fc1bea99accb50b35d481ede92b3bcab640f35a2dd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\ddsa.scr"C:\ddsa.scr" /S2⤵
- Executes dropped EXE
PID:940
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:2004
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5e8859805a60de5f9136e228bcc882130
SHA1eabe83f7bf0c9d1ab94076b589ba30fd98bd0fe0
SHA25602e0c39a93abecfc79a805ac367cf04c20484b779fd0cf7b33d01b6781d08a69
SHA51292ead6ea74d28506b6dcb78b8fe3dbb699cc7a012402359884420fb5477a158f9fc0855b6dd4285e634057b057976d388fa71acd6d9f9f2184c5e7a2dde7bbb5
-
Filesize
8KB
MD53e9f18d134cb34e0575365bdad55f155
SHA114206f0887576eabe296b15881260b3ad2bf7709
SHA2560cd0bcb93e7d4fa0fe4db223e914e723b4ebb4d81312cb4357f36a14edba2df2
SHA51277a1353217df765ffd74f3b4b464c1edd86b8386e30aabda218e5d5610a981c7720164f9acda045fed5ed5c2cd914a144637a86d08b492a5b7f04bcb3b007612
