Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
179s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
19/11/2022, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe
-
Size
388KB
-
MD5
2557cdb9f495107cacba536a0338d5f0
-
SHA1
7a034ec992d17c6e7bd0ca97121585be1f66fca2
-
SHA256
4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5
-
SHA512
5bf37419495bd623a4f51c03c720bbfb75f06f6522a5db24f99b41d9034912a0de35bb64e94f81c2882165c74a9d34aa9b4af9f5e36941a8924913eba4106687
-
SSDEEP
6144:LYHeIdOLd7RI0zjnyXKzAzEVJXW2PQwpU7k95fcLlfXDTGqAed:LYHe7RI/KjnZRm7gfs
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{37AAD372-DEE8-476F-9E4D-8FC64CE65039}\\f5ea51da.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{37AAD372-DEE8-476F-9E4D-8FC64CE65039}\\f5ea51da.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1420 set thread context of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1276 Explorer.EXE -
Suspicious behavior: MapViewOfSection 26 IoCs
pid Process 1984 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 1984 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe 1512 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeDebugPrivilege 1512 svchost.exe Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeSystemtimePrivilege 872 Process not Found Token: SeBackupPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeShutdownPrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeUndockPrivilege 872 Process not Found Token: SeManageVolumePrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe -
Suspicious use of UnmapMainImage 6 IoCs
pid Process 804 Process not Found 804 Process not Found 804 Process not Found 804 Process not Found 804 Process not Found 804 Process not Found -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1420 wrote to memory of 1984 1420 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 28 PID 1984 wrote to memory of 1512 1984 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 29 PID 1984 wrote to memory of 1512 1984 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 29 PID 1984 wrote to memory of 1512 1984 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 29 PID 1984 wrote to memory of 1512 1984 4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe 29 PID 388 wrote to memory of 1276 388 Process not Found 13
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe"C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe"C:\Users\Admin\AppData\Local\Temp\4e2e2178b33c088912a8f271f626969e38b586b5fddbe21f464dc7ee453073a5.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
-