Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/11/2022, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe
Resource
win10v2004-20220812-en
General
-
Target
7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe
-
Size
201KB
-
MD5
23fa0fef80fa2e8ba41ae5546a27c13c
-
SHA1
f5e41fa9f767247df59fb40b1ac423fb700f8f55
-
SHA256
7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde
-
SHA512
64719f22b06a5ad498eedb605051454e123607908feaf20af6a4042ddc1dc3ae523973e1f5a1c3ca27443d670f46ca66aaf51b72756f1c902109e459dc4caea5
-
SSDEEP
6144:Hza2Nj+MLxwkcWTq/81DDiSTz9nqEja3TXU0xtFE:HqEjk7l7FE
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 828 security.exe 776 security.exe -
resource yara_rule behavioral1/memory/1272-83-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1272-85-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1272-86-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1272-89-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1272-90-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1272-93-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/1272-133-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/776-134-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/776-136-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Loads dropped DLL 5 IoCs
pid Process 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Security = "C:\\Users\\Admin\\AppData\\Roaming\\Security\\security.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1632 set thread context of 1272 1632 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 28 PID 828 set thread context of 776 828 security.exe 33 PID 828 set thread context of 532 828 security.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe Token: SeDebugPrivilege 776 security.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1632 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 828 security.exe 776 security.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1272 1632 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 28 PID 1632 wrote to memory of 1272 1632 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 28 PID 1632 wrote to memory of 1272 1632 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 28 PID 1632 wrote to memory of 1272 1632 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 28 PID 1632 wrote to memory of 1272 1632 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 28 PID 1632 wrote to memory of 1272 1632 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 28 PID 1632 wrote to memory of 1272 1632 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 28 PID 1632 wrote to memory of 1272 1632 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 28 PID 1272 wrote to memory of 320 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 29 PID 1272 wrote to memory of 320 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 29 PID 1272 wrote to memory of 320 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 29 PID 1272 wrote to memory of 320 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 29 PID 320 wrote to memory of 1396 320 cmd.exe 31 PID 320 wrote to memory of 1396 320 cmd.exe 31 PID 320 wrote to memory of 1396 320 cmd.exe 31 PID 320 wrote to memory of 1396 320 cmd.exe 31 PID 1272 wrote to memory of 828 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 32 PID 1272 wrote to memory of 828 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 32 PID 1272 wrote to memory of 828 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 32 PID 1272 wrote to memory of 828 1272 7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe 32 PID 828 wrote to memory of 776 828 security.exe 33 PID 828 wrote to memory of 776 828 security.exe 33 PID 828 wrote to memory of 776 828 security.exe 33 PID 828 wrote to memory of 776 828 security.exe 33 PID 828 wrote to memory of 776 828 security.exe 33 PID 828 wrote to memory of 776 828 security.exe 33 PID 828 wrote to memory of 776 828 security.exe 33 PID 828 wrote to memory of 776 828 security.exe 33 PID 828 wrote to memory of 532 828 security.exe 34 PID 828 wrote to memory of 532 828 security.exe 34 PID 828 wrote to memory of 532 828 security.exe 34 PID 828 wrote to memory of 532 828 security.exe 34 PID 828 wrote to memory of 532 828 security.exe 34 PID 828 wrote to memory of 532 828 security.exe 34 PID 828 wrote to memory of 532 828 security.exe 34 PID 828 wrote to memory of 532 828 security.exe 34 PID 828 wrote to memory of 532 828 security.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe"C:\Users\Admin\AppData\Local\Temp\7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe"C:\Users\Admin\AppData\Local\Temp\7881b2cfe55300fc082312e109b8f226010fe586999c9ca87da7dbe0daad2bde.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\DLXBY.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Security" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Security\security.exe" /f4⤵
- Adds Run key to start application
PID:1396
-
-
-
C:\Users\Admin\AppData\Roaming\Security\security.exe"C:\Users\Admin\AppData\Roaming\Security\security.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Roaming\Security\security.exe"C:\Users\Admin\AppData\Roaming\Security\security.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:776
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵PID:532
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
147B
MD56f473a1ba53e043362047f72e20b34f4
SHA1e8f121a589e1207ed950453376ee1d21b1223835
SHA2565fbce2c77a90ba9edbcf60be3851ab81633b7c10b1babb624d475c7be589de4b
SHA512b4976d40bc708ae6cddf367a5382cd532e4cf235b848cdaa4e4d317e06d9126e50745a7772591bc21dc7380689f4399e57501b0aa73cd231bce32e22d53b0818
-
Filesize
201KB
MD52f3b8f5117b48b087c787499d38af996
SHA18bb4855a71ac345b726fc51424e39461c122f4cf
SHA2562531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63
SHA5122b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092
-
Filesize
201KB
MD52f3b8f5117b48b087c787499d38af996
SHA18bb4855a71ac345b726fc51424e39461c122f4cf
SHA2562531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63
SHA5122b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092
-
Filesize
201KB
MD52f3b8f5117b48b087c787499d38af996
SHA18bb4855a71ac345b726fc51424e39461c122f4cf
SHA2562531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63
SHA5122b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092
-
Filesize
201KB
MD52f3b8f5117b48b087c787499d38af996
SHA18bb4855a71ac345b726fc51424e39461c122f4cf
SHA2562531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63
SHA5122b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092
-
Filesize
201KB
MD52f3b8f5117b48b087c787499d38af996
SHA18bb4855a71ac345b726fc51424e39461c122f4cf
SHA2562531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63
SHA5122b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092
-
Filesize
201KB
MD52f3b8f5117b48b087c787499d38af996
SHA18bb4855a71ac345b726fc51424e39461c122f4cf
SHA2562531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63
SHA5122b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092
-
Filesize
201KB
MD52f3b8f5117b48b087c787499d38af996
SHA18bb4855a71ac345b726fc51424e39461c122f4cf
SHA2562531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63
SHA5122b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092
-
Filesize
201KB
MD52f3b8f5117b48b087c787499d38af996
SHA18bb4855a71ac345b726fc51424e39461c122f4cf
SHA2562531823115be77060e2bc0d1ab588ddfddf690b4b45ec91aad2abf5d1efdfc63
SHA5122b059d3315baa141e4232724221d97f7b63e7e5ad34669993b34f83859b3c063181505a0e5ac0517f9a6ef7df154840c2eeda5c9c4d766ddbe35e13637a3c092