Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2022, 15:13

General

  • Target

    5fc5c71df2d5ca00bfb0732351a8aac2c7b3e32c6f871c7ebe781b77e226717b.exe

  • Size

    512KB

  • MD5

    22bdc1774f32565d23c36e3d118097dc

  • SHA1

    8e212378366104fc9bae24fcffd9f97a88227c63

  • SHA256

    5fc5c71df2d5ca00bfb0732351a8aac2c7b3e32c6f871c7ebe781b77e226717b

  • SHA512

    c97c2ec052d99266ef8582400ab0dfa832882592b0a38441bafc452bdc0dad5a84d207a3e6a846f192e88164766f98498947335c83787fd17d4f15897dd8fb58

  • SSDEEP

    12288:b1dlZo5yUkDRZKlxJ9eCn9BoF/HtMB56R+nh6TnACZC5I+:b1dlZo5EDoxf6pHSb63UI0I+

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Executes dropped EXE 6 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:480
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:464
        • C:\Windows\system32\taskhost.exe
          "taskhost.exe"
          2⤵
            PID:1220
          • C:\Windows\system32\sppsvc.exe
            C:\Windows\system32\sppsvc.exe
            2⤵
              PID:760
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
              2⤵
                PID:920
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                2⤵
                  PID:1052
                • C:\Windows\System32\spoolsv.exe
                  C:\Windows\System32\spoolsv.exe
                  2⤵
                    PID:300
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k NetworkService
                    2⤵
                      PID:276
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs
                      2⤵
                        PID:888
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalService
                        2⤵
                          PID:848
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                          2⤵
                            PID:820
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                            2⤵
                              PID:744
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k RPCSS
                              2⤵
                                PID:672
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k DcomLaunch
                                2⤵
                                  PID:592
                              • C:\Windows\system32\winlogon.exe
                                winlogon.exe
                                1⤵
                                  PID:420
                                • C:\Windows\system32\wininit.exe
                                  wininit.exe
                                  1⤵
                                    PID:380
                                    • C:\Windows\system32\lsm.exe
                                      C:\Windows\system32\lsm.exe
                                      2⤵
                                        PID:488
                                    • C:\Windows\system32\csrss.exe
                                      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                      1⤵
                                        PID:372
                                      • C:\Windows\system32\csrss.exe
                                        %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                        1⤵
                                          PID:336
                                        • C:\Windows\System32\smss.exe
                                          \SystemRoot\System32\smss.exe
                                          1⤵
                                            PID:260
                                          • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                                            wmiadap.exe /F /T /R
                                            1⤵
                                              PID:1936
                                            • C:\Windows\Explorer.EXE
                                              C:\Windows\Explorer.EXE
                                              1⤵
                                                PID:1372
                                                • C:\Users\Admin\AppData\Local\Temp\5fc5c71df2d5ca00bfb0732351a8aac2c7b3e32c6f871c7ebe781b77e226717b.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\5fc5c71df2d5ca00bfb0732351a8aac2c7b3e32c6f871c7ebe781b77e226717b.exe"
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1756
                                                  • C:\Extracted\CLEAN.exe
                                                    "C:\Extracted\CLEAN.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2008
                                                    • C:\Extracted\CLEAN.exe
                                                      C:\Extracted\CLEAN.exe
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:572
                                                      • C:\Extracted\CLEAN.exe
                                                        C:\Extracted\CLEAN.exe
                                                        5⤵
                                                        • Adds policy Run key to start application
                                                        • Executes dropped EXE
                                                        • Modifies Installed Components in the registry
                                                        • Loads dropped DLL
                                                        • Adds Run key to start application
                                                        • Drops file in Program Files directory
                                                        PID:1680
                                                        • C:\Program Files (x86)\Windowd UN\svchosty.exe
                                                          "C:\Program Files (x86)\Windowd UN\svchosty.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2040
                                                          • C:\Program Files (x86)\Windowd UN\svchosty.exe
                                                            "C:\Program Files (x86)\Windowd UN\svchosty.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1624
                                                            • C:\Program Files (x86)\Windowd UN\svchosty.exe
                                                              "C:\Program Files (x86)\Windowd UN\svchosty.exe"
                                                              8⤵
                                                              • Executes dropped EXE
                                                              • Modifies Installed Components in the registry
                                                              • Drops file in Program Files directory
                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1488
                                              • C:\Windows\system32\Dwm.exe
                                                "C:\Windows\system32\Dwm.exe"
                                                1⤵
                                                  PID:1308

                                                Network

                                                MITRE ATT&CK Enterprise v6

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Extracted\CLEAN.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • C:\Extracted\CLEAN.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • C:\Extracted\CLEAN.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • C:\Extracted\CLEAN.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • C:\Program Files (x86)\Windowd UN\svchosty.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • C:\Program Files (x86)\Windowd UN\svchosty.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • C:\Program Files (x86)\Windowd UN\svchosty.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • C:\Program Files (x86)\Windowd UN\svchosty.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • \Extracted\CLEAN.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • \Extracted\CLEAN.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • \Program Files (x86)\Windowd UN\svchosty.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • \Program Files (x86)\Windowd UN\svchosty.exe

                                                  Filesize

                                                  176KB

                                                  MD5

                                                  14bbe284f5dbea370c72086a6cf9c285

                                                  SHA1

                                                  d64f1da8480a238f0fafd4a52c1ffe38729ee415

                                                  SHA256

                                                  e379873c5f9386e5fac3f2d44f631731527a14ab392b917b9f888e0599697f6e

                                                  SHA512

                                                  c4e4c14ff77d636a3a4adf7a378863b1705cb7313afb90dfe288cd5f1bedd2690b5425bbb35fc3772e292fbd4cda043529802d98eee946e31946153228454209

                                                • memory/260-95-0x0000000010410000-0x000000001041A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/572-116-0x0000000010440000-0x000000001044A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/572-134-0x0000000010460000-0x000000001046A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/572-73-0x0000000000400000-0x0000000000428000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/572-75-0x0000000000270000-0x000000000027A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/572-82-0x0000000000280000-0x000000000028A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/572-89-0x0000000010410000-0x000000001041A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/572-71-0x0000000000400000-0x0000000000428000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/572-98-0x0000000010420000-0x000000001042A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/572-107-0x0000000010430000-0x000000001043A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/572-65-0x0000000000400000-0x0000000000428000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/572-125-0x0000000010450000-0x000000001045A000-memory.dmp

                                                  Filesize

                                                  40KB

                                                • memory/572-259-0x0000000000400000-0x0000000000428000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/572-305-0x0000000000400000-0x0000000000428000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/572-70-0x0000000000400000-0x0000000000428000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/1488-513-0x0000000010590000-0x00000000105C6000-memory.dmp

                                                  Filesize

                                                  216KB

                                                • memory/1488-514-0x0000000010590000-0x00000000105C6000-memory.dmp

                                                  Filesize

                                                  216KB

                                                • memory/1624-512-0x0000000000400000-0x0000000000428000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/1624-473-0x0000000000400000-0x0000000000428000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/1624-325-0x0000000000400000-0x0000000000428000-memory.dmp

                                                  Filesize

                                                  160KB

                                                • memory/1680-308-0x0000000010580000-0x00000000105B6000-memory.dmp

                                                  Filesize

                                                  216KB

                                                • memory/1680-307-0x0000000000400000-0x0000000000472000-memory.dmp

                                                  Filesize

                                                  456KB

                                                • memory/1756-61-0x0000000003400000-0x0000000003472000-memory.dmp

                                                  Filesize

                                                  456KB

                                                • memory/1756-62-0x0000000003400000-0x0000000003472000-memory.dmp

                                                  Filesize

                                                  456KB

                                                • memory/1756-54-0x0000000076691000-0x0000000076693000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/2008-63-0x0000000000400000-0x0000000000472000-memory.dmp

                                                  Filesize

                                                  456KB

                                                • memory/2008-72-0x0000000000400000-0x0000000000472000-memory.dmp

                                                  Filesize

                                                  456KB

                                                • memory/2040-315-0x0000000000400000-0x0000000000472000-memory.dmp

                                                  Filesize

                                                  456KB

                                                • memory/2040-324-0x0000000000400000-0x0000000000472000-memory.dmp

                                                  Filesize

                                                  456KB