Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
08/11/2022, 05:03
Static task
static1
Behavioral task
behavioral1
Sample
aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
-
Size
344KB
-
MD5
14a20867d0d6519be768b17ad3cefefe
-
SHA1
c955e587f0f84df8cfd27b23f70be1de11253b29
-
SHA256
aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3
-
SHA512
69b50b95e59ccd2e19577e22560edff5d63c844558b05456481c83d7678dff50a99798ff7132b0aeb728795f14fe77222096a3b5e2296fdb80b95ca310f2807e
-
SSDEEP
6144:RerQu7SGFRDauuLk8fk3tdG2smOOHhmlbobTfCF9NRRya6AE7Gya6AE:UcKSyQ2dBhhmlbot
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6815cdb9 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{73E5EA05-2EC3-4D34-9D53-31C15E7E1B90}\\6815cdb9.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6815cdb9 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{73E5EA05-2EC3-4D34-9D53-31C15E7E1B90}\\6815cdb9.exe" svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 400 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe 400 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe Token: SeDebugPrivilege 3952 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 400 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 400 wrote to memory of 3952 400 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe 82 PID 400 wrote to memory of 3952 400 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe 82 PID 400 wrote to memory of 3952 400 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe"C:\Users\Admin\AppData\Local\Temp\aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3952
-