Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 11:28
Static task
static1
Behavioral task
behavioral1
Sample
9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe
Resource
win10v2004-20220812-en
General
-
Target
9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe
-
Size
231KB
-
MD5
0f2d2be5d9800794b23a1912ba246251
-
SHA1
a2efb31f80432227de63a96177f8d54087593f11
-
SHA256
9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320
-
SHA512
9338d1a8b643632c1c2539fc708d8474547cc051e70c9a7ae532d0c9f42d9a05baf6c2f74862cd5d45557e0dc785b997d0ff9c7b3638688819ece414dc3d7f43
-
SSDEEP
3072:gZ6S2r9wAru5P5ZXcSNAA3x0Ee9FdEKcwAuTkqb//npGc6hnI1dAF9NAqwv:gsr9wArAPXcXexgrcwAm7PAcwnIgAR
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 3592 EC9BF84DC25.exe 2204 EC9BF84DC25.exe 3500 wZg21E0.exe -
resource yara_rule behavioral2/memory/3144-133-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral2/memory/3144-135-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral2/memory/3144-136-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral2/memory/3144-140-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral2/memory/2204-156-0x0000000000400000-0x0000000000468000-memory.dmp upx behavioral2/memory/3144-224-0x0000000000400000-0x0000000000468000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN wZg21E0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0G0A8D3C7UWI2B7WJQFHWVTFBILGRFO = "C:\\wndows\\EC9BF84DC25.exe /q" wZg21E0.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3504 set thread context of 3144 3504 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 78 PID 3592 set thread context of 2204 3592 EC9BF84DC25.exe 80 -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\PhishingFilter wZg21E0.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" wZg21E0.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" wZg21E0.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery wZg21E0.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" wZg21E0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3144 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 3144 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 3144 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 3144 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 2204 EC9BF84DC25.exe 2204 EC9BF84DC25.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe 3500 wZg21E0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3144 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe Token: SeDebugPrivilege 3144 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe Token: SeDebugPrivilege 3144 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe Token: SeDebugPrivilege 3144 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe Token: SeDebugPrivilege 2204 EC9BF84DC25.exe Token: SeDebugPrivilege 2204 EC9BF84DC25.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe Token: SeDebugPrivilege 3500 wZg21E0.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3504 wrote to memory of 3144 3504 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 78 PID 3504 wrote to memory of 3144 3504 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 78 PID 3504 wrote to memory of 3144 3504 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 78 PID 3504 wrote to memory of 3144 3504 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 78 PID 3504 wrote to memory of 3144 3504 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 78 PID 3504 wrote to memory of 3144 3504 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 78 PID 3504 wrote to memory of 3144 3504 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 78 PID 3504 wrote to memory of 3144 3504 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 78 PID 3144 wrote to memory of 3592 3144 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 79 PID 3144 wrote to memory of 3592 3144 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 79 PID 3144 wrote to memory of 3592 3144 9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe 79 PID 3592 wrote to memory of 2204 3592 EC9BF84DC25.exe 80 PID 3592 wrote to memory of 2204 3592 EC9BF84DC25.exe 80 PID 3592 wrote to memory of 2204 3592 EC9BF84DC25.exe 80 PID 3592 wrote to memory of 2204 3592 EC9BF84DC25.exe 80 PID 3592 wrote to memory of 2204 3592 EC9BF84DC25.exe 80 PID 3592 wrote to memory of 2204 3592 EC9BF84DC25.exe 80 PID 3592 wrote to memory of 2204 3592 EC9BF84DC25.exe 80 PID 3592 wrote to memory of 2204 3592 EC9BF84DC25.exe 80 PID 2204 wrote to memory of 3500 2204 EC9BF84DC25.exe 81 PID 2204 wrote to memory of 3500 2204 EC9BF84DC25.exe 81 PID 2204 wrote to memory of 3500 2204 EC9BF84DC25.exe 81 PID 2204 wrote to memory of 3500 2204 EC9BF84DC25.exe 81 PID 2204 wrote to memory of 3500 2204 EC9BF84DC25.exe 81 PID 3500 wrote to memory of 3144 3500 wZg21E0.exe 78 PID 3500 wrote to memory of 3144 3500 wZg21E0.exe 78 PID 3500 wrote to memory of 3144 3500 wZg21E0.exe 78 PID 3500 wrote to memory of 3144 3500 wZg21E0.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe"C:\Users\Admin\AppData\Local\Temp\9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exeC:\Users\Admin\AppData\Local\Temp\9cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\wndows\EC9BF84DC25.exe"C:\wndows\EC9BF84DC25.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\wndows\EC9BF84DC25.exeC:\wndows\EC9BF84DC25.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\wZg21E0.exe"C:\Users\Admin\AppData\Local\Temp\wZg21E0.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3500
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be
-
Filesize
38KB
MD54e9f5e19f191a321dbcf2a863f701b30
SHA1f87421ee6c12379c868e9880609c876b1d66c4c8
SHA2560404c386355b8b4db2d2773b36b5b84260ef55defc1beb92ca522d03d1113278
SHA512cf6b08db8a2b4d13b24a1e63757c15d0e4ea85eea23b3ec83c5ce590c6c308b5c19f489f0b92633a50b7b8f7ba1c410b656a1308d7e583d9f3374d6aef7ec46a
-
Filesize
231KB
MD50f2d2be5d9800794b23a1912ba246251
SHA1a2efb31f80432227de63a96177f8d54087593f11
SHA2569cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320
SHA5129338d1a8b643632c1c2539fc708d8474547cc051e70c9a7ae532d0c9f42d9a05baf6c2f74862cd5d45557e0dc785b997d0ff9c7b3638688819ece414dc3d7f43
-
Filesize
231KB
MD50f2d2be5d9800794b23a1912ba246251
SHA1a2efb31f80432227de63a96177f8d54087593f11
SHA2569cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320
SHA5129338d1a8b643632c1c2539fc708d8474547cc051e70c9a7ae532d0c9f42d9a05baf6c2f74862cd5d45557e0dc785b997d0ff9c7b3638688819ece414dc3d7f43
-
Filesize
231KB
MD50f2d2be5d9800794b23a1912ba246251
SHA1a2efb31f80432227de63a96177f8d54087593f11
SHA2569cfee1993bd2ba3b348c86e4e2e87a001d3dc435a60d9cb3d1f40488939d0320
SHA5129338d1a8b643632c1c2539fc708d8474547cc051e70c9a7ae532d0c9f42d9a05baf6c2f74862cd5d45557e0dc785b997d0ff9c7b3638688819ece414dc3d7f43