Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 17:14
Behavioral task
behavioral1
Sample
db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe
-
Size
312KB
-
MD5
0fc898ac90039678acb755f4bc8a40e2
-
SHA1
de01e232b99b995a90dc6713449774c3655c251e
-
SHA256
db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d
-
SHA512
b85505c735974076eabb5690b4747c79d48f79ec271cd64f9c754d543380feecbedb5539daffd51637fdbcd418362ae5aa05928c37eded09acddfa7aa6857ca9
-
SSDEEP
6144:PVzc8JNX3lnTPL2STxinek3hiA7rXIB/qfunfieFlk9:Zc8L3lnH2Snk3YA7rXIBCGnKeQ9
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1816-54-0x0000000001000000-0x0000000001078000-memory.dmp upx behavioral1/memory/1816-96-0x0000000001000000-0x0000000001078000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\Z: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\E: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\G: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\H: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\Q: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\R: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\F: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\U: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\X: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\S: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\T: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\W: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\K: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\M: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\N: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\O: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\P: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\Y: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\I: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\J: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened (read-only) \??\L: db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\lsass.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\ieetwcollector.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\ui0detect.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File created \??\c:\windows\SysWOW64\svchost.vir db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File created \??\c:\windows\SysWOW64\dllhost.vir db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File created \??\c:\windows\SysWOW64\msiexec.vir db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File created \??\c:\windows\SysWOW64\searchindexer.vir db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files\google\chrome\Application\89.0.4389.114\elevation_service.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\7-Zip\7zG.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\source engine\ose.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\7-Zip\7z.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File created C:\Program Files\7-Zip\Uninstall.vir db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A8892F22-5C7C-49AB-B10A-4481A64BEC1B}.crmlog dllhost.exe File opened for modification \??\c:\windows\ehome\ehrecvr.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{A8892F22-5C7C-49AB-B10A-4481A64BEC1B}.crmlog dllhost.exe File opened for modification \??\c:\windows\ehome\ehsched.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap SearchIndexer.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1816 db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe Token: SeRestorePrivilege 1180 msiexec.exe Token: SeTakeOwnershipPrivilege 1180 msiexec.exe Token: SeSecurityPrivilege 1180 msiexec.exe Token: SeManageVolumePrivilege 1744 SearchIndexer.exe Token: 33 1744 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1744 SearchIndexer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1012 SearchProtocolHost.exe 1012 SearchProtocolHost.exe 1012 SearchProtocolHost.exe 1012 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1744 wrote to memory of 1012 1744 SearchIndexer.exe 30 PID 1744 wrote to memory of 1012 1744 SearchIndexer.exe 30 PID 1744 wrote to memory of 1012 1744 SearchIndexer.exe 30 PID 1744 wrote to memory of 1392 1744 SearchIndexer.exe 31 PID 1744 wrote to memory of 1392 1744 SearchIndexer.exe 31 PID 1744 wrote to memory of 1392 1744 SearchIndexer.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe"C:\Users\Admin\AppData\Local\Temp\db6ef0fb8a09e3e193f32e8bdc55ed75e8c3c88a2a081fd97bc068902f82ee5d.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1816
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
PID:2036
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4063495947-34355257-727531523-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4063495947-34355257-727531523-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
- Suspicious use of SetWindowsHookEx
PID:1012
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 512 516 524 65536 5202⤵PID:1392
-