Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe
Resource
win10v2004-20221111-en
General
-
Target
d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe
-
Size
183KB
-
MD5
2151c09c1db2a9a08ca36b2c77c84630
-
SHA1
e104bb0bf94d0b48c2d9751ed6e1cac442e5b46c
-
SHA256
d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878
-
SHA512
fb59dd97098d932ead43bd8783ecbfb6ef04c54c94035d41a502e3636009a3bab106d72e0b8f5425f2bfad9ccd02a78d6e77b2f367b43a8559e30b4c376d9159
-
SSDEEP
3072:WhZMMCvQj0eTvmQM3gu+lJw+uL8mhbqIXE/iOMHg2c8uXsAV:kZmUXTvmQgguDLOixHg2c8iV
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x000b0000000122f6-55.dat aspack_v212_v242 behavioral1/files/0x0009000000012311-60.dat aspack_v212_v242 behavioral1/files/0x000b0000000122f6-59.dat aspack_v212_v242 behavioral1/files/0x000900000001230a-66.dat aspack_v212_v242 behavioral1/files/0x000900000001230a-67.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1952 16b04c30.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 16b04c30.exe -
resource yara_rule behavioral1/files/0x000b0000000122f6-55.dat upx behavioral1/memory/1952-58-0x0000000000F20000-0x0000000000F44000-memory.dmp upx behavioral1/memory/1952-57-0x0000000000F20000-0x0000000000F44000-memory.dmp upx behavioral1/files/0x0009000000012311-60.dat upx behavioral1/files/0x000b0000000122f6-59.dat upx behavioral1/memory/1952-63-0x0000000000F20000-0x0000000000F44000-memory.dmp upx behavioral1/files/0x000900000001230a-66.dat upx behavioral1/files/0x000900000001230a-67.dat upx behavioral1/memory/1768-69-0x00000000744B0000-0x00000000744D4000-memory.dmp upx behavioral1/memory/1768-70-0x00000000744B0000-0x00000000744D4000-memory.dmp upx behavioral1/memory/1768-72-0x00000000744B0000-0x00000000744D4000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1952 16b04c30.exe 1768 Svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\0EFD04C4.tmp 16b04c30.exe File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 16b04c30.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1952 16b04c30.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1952 1976 d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe 28 PID 1976 wrote to memory of 1952 1976 d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe 28 PID 1976 wrote to memory of 1952 1976 d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe 28 PID 1976 wrote to memory of 1952 1976 d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe"C:\Users\Admin\AppData\Local\Temp\d3ad8635898120745699b31093d2c90207b7b1dae3fd32a62fcdd63a5e37d878.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\16b04c30.exeC:\16b04c30.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1952
-
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\SysWOW64\Svchost.exe -k netsvcs1⤵
- Loads dropped DLL
PID:1768
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143KB
MD5d4b4d82ddb32ea8de49571df94b08e14
SHA17f0702725855422e5ded1dd247522ccb982b162e
SHA256f9e7662a3eee2174d38ca7b6b598120861aab6456d1bf9da74f8b3e9dabec340
SHA512cafd822d17eb7ce96f21570329ca223bf7e8f5cdebd4705fd8fe1b7828b0d40d6a0b2c909fc5f561890787a9f7ccb2d3bf77c578019227cd7ff6a4902c49d256
-
Filesize
143KB
MD5d4b4d82ddb32ea8de49571df94b08e14
SHA17f0702725855422e5ded1dd247522ccb982b162e
SHA256f9e7662a3eee2174d38ca7b6b598120861aab6456d1bf9da74f8b3e9dabec340
SHA512cafd822d17eb7ce96f21570329ca223bf7e8f5cdebd4705fd8fe1b7828b0d40d6a0b2c909fc5f561890787a9f7ccb2d3bf77c578019227cd7ff6a4902c49d256
-
Filesize
720B
MD5da03aa0be64504edb0884ce0eae258d7
SHA1e100d24f88a0ae9f85562996b612c1024e9fc610
SHA2560dad20c35559e58b0a559abbc3a3acecd916d4304aef07f73b32be78f11769dd
SHA512530d4c496d5514f213cb6bb2f3df4370348617582f05c35fc8d2f42761baa1b4e21dabd6df57b462b68b86280859270c07c8d271bafc0024f49e6d10b4320ada
-
Filesize
143KB
MD5ab5db2af8f8e8f5ce0defc51d21e8963
SHA1577e8eb5d7f97eed02a18704b30dfff7eac1260a
SHA2564ec4fdedcdcddbc6c81d02a0080d3fda417cb4fa16c4b1fd2f83a3e4e25f49ce
SHA512e391f0e450d1fbe40165a21eaadcdfeb46fb1a92bd395e2a3c466cbc99ee8081729f24200ee619af162d06df5d4159d77959d8f374597616d1b1e18dcfb748fa
-
Filesize
143KB
MD5ab5db2af8f8e8f5ce0defc51d21e8963
SHA1577e8eb5d7f97eed02a18704b30dfff7eac1260a
SHA2564ec4fdedcdcddbc6c81d02a0080d3fda417cb4fa16c4b1fd2f83a3e4e25f49ce
SHA512e391f0e450d1fbe40165a21eaadcdfeb46fb1a92bd395e2a3c466cbc99ee8081729f24200ee619af162d06df5d4159d77959d8f374597616d1b1e18dcfb748fa
-
Filesize
143KB
MD5ab5db2af8f8e8f5ce0defc51d21e8963
SHA1577e8eb5d7f97eed02a18704b30dfff7eac1260a
SHA2564ec4fdedcdcddbc6c81d02a0080d3fda417cb4fa16c4b1fd2f83a3e4e25f49ce
SHA512e391f0e450d1fbe40165a21eaadcdfeb46fb1a92bd395e2a3c466cbc99ee8081729f24200ee619af162d06df5d4159d77959d8f374597616d1b1e18dcfb748fa