Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
2abb45ab0e2c1482e7bd80909cb4ad6cf9a3fbfe67c7e1823204ebf663cc89ee.dll
Resource
win7-20221111-en
General
-
Target
2abb45ab0e2c1482e7bd80909cb4ad6cf9a3fbfe67c7e1823204ebf663cc89ee.dll
-
Size
1.0MB
-
MD5
1ffdc5523571842b75b71dfdc86e538a
-
SHA1
f448e59b8545b185ade91ae0e69a3d70aff170eb
-
SHA256
2abb45ab0e2c1482e7bd80909cb4ad6cf9a3fbfe67c7e1823204ebf663cc89ee
-
SHA512
ec58434a67faa54a9ad2c46cc8542df2881d7e5540c6b813aaa84db67212894744187a8faa0ad9981cad7e317012c6e8587b4ed5e092c71da0c98554bc36f8b6
-
SSDEEP
24576:mNHDssXka/yPQPYlYfeZebgKEIeqmvf7a49:gXk+CekKbeqSWe
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,c:\\program files (x86)\\microsoft\\watermark.exe" svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 948 regsvr32mgr.exe 316 WaterMark.exe -
resource yara_rule behavioral1/memory/948-63-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/948-64-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/948-70-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral1/memory/316-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/316-150-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Loads dropped DLL 4 IoCs
pid Process 1432 regsvr32.exe 1432 regsvr32.exe 948 regsvr32mgr.exe 948 regsvr32mgr.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\dmlconf.dat svchost.exe File opened for modification C:\Windows\SysWOW64\dmlconf.dat svchost.exe File created C:\Windows\SysWOW64\regsvr32mgr.exe regsvr32.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px9474.tmp regsvr32mgr.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe regsvr32mgr.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe regsvr32mgr.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll svchost.exe File opened for modification C:\Program Files\7-Zip\7z.dll svchost.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c0164c20-33c8-4f60-bfd1-557e08a93f58}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c0164c20-33c8-4f60-bfd1-557e08a93f58} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c0164c20-33c8-4f60-bfd1-557e08a93f58}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2abb45ab0e2c1482e7bd80909cb4ad6cf9a3fbfe67c7e1823204ebf663cc89ee.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ec48db94-98df-4c2f-932f-bbc28af0a316} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ec48db94-98df-4c2f-932f-bbc28af0a316}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c0164c20-33c8-4f60-bfd1-557e08a93f58}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ec48db94-98df-4c2f-932f-bbc28af0a316}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ec48db94-98df-4c2f-932f-bbc28af0a316}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2abb45ab0e2c1482e7bd80909cb4ad6cf9a3fbfe67c7e1823204ebf663cc89ee.dll" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 316 WaterMark.exe 316 WaterMark.exe 316 WaterMark.exe 316 WaterMark.exe 316 WaterMark.exe 316 WaterMark.exe 316 WaterMark.exe 316 WaterMark.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe 284 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 316 WaterMark.exe Token: SeDebugPrivilege 284 svchost.exe Token: SeDebugPrivilege 316 WaterMark.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 948 regsvr32mgr.exe 316 WaterMark.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 1432 1792 regsvr32.exe 28 PID 1792 wrote to memory of 1432 1792 regsvr32.exe 28 PID 1792 wrote to memory of 1432 1792 regsvr32.exe 28 PID 1792 wrote to memory of 1432 1792 regsvr32.exe 28 PID 1792 wrote to memory of 1432 1792 regsvr32.exe 28 PID 1792 wrote to memory of 1432 1792 regsvr32.exe 28 PID 1792 wrote to memory of 1432 1792 regsvr32.exe 28 PID 1432 wrote to memory of 948 1432 regsvr32.exe 29 PID 1432 wrote to memory of 948 1432 regsvr32.exe 29 PID 1432 wrote to memory of 948 1432 regsvr32.exe 29 PID 1432 wrote to memory of 948 1432 regsvr32.exe 29 PID 948 wrote to memory of 316 948 regsvr32mgr.exe 30 PID 948 wrote to memory of 316 948 regsvr32mgr.exe 30 PID 948 wrote to memory of 316 948 regsvr32mgr.exe 30 PID 948 wrote to memory of 316 948 regsvr32mgr.exe 30 PID 316 wrote to memory of 1184 316 WaterMark.exe 31 PID 316 wrote to memory of 1184 316 WaterMark.exe 31 PID 316 wrote to memory of 1184 316 WaterMark.exe 31 PID 316 wrote to memory of 1184 316 WaterMark.exe 31 PID 316 wrote to memory of 1184 316 WaterMark.exe 31 PID 316 wrote to memory of 1184 316 WaterMark.exe 31 PID 316 wrote to memory of 1184 316 WaterMark.exe 31 PID 316 wrote to memory of 1184 316 WaterMark.exe 31 PID 316 wrote to memory of 1184 316 WaterMark.exe 31 PID 316 wrote to memory of 1184 316 WaterMark.exe 31 PID 316 wrote to memory of 284 316 WaterMark.exe 32 PID 316 wrote to memory of 284 316 WaterMark.exe 32 PID 316 wrote to memory of 284 316 WaterMark.exe 32 PID 316 wrote to memory of 284 316 WaterMark.exe 32 PID 316 wrote to memory of 284 316 WaterMark.exe 32 PID 316 wrote to memory of 284 316 WaterMark.exe 32 PID 316 wrote to memory of 284 316 WaterMark.exe 32 PID 316 wrote to memory of 284 316 WaterMark.exe 32 PID 316 wrote to memory of 284 316 WaterMark.exe 32 PID 316 wrote to memory of 284 316 WaterMark.exe 32 PID 284 wrote to memory of 260 284 svchost.exe 26 PID 284 wrote to memory of 260 284 svchost.exe 26 PID 284 wrote to memory of 260 284 svchost.exe 26 PID 284 wrote to memory of 260 284 svchost.exe 26 PID 284 wrote to memory of 260 284 svchost.exe 26 PID 284 wrote to memory of 332 284 svchost.exe 6 PID 284 wrote to memory of 332 284 svchost.exe 6 PID 284 wrote to memory of 332 284 svchost.exe 6 PID 284 wrote to memory of 332 284 svchost.exe 6 PID 284 wrote to memory of 332 284 svchost.exe 6 PID 284 wrote to memory of 368 284 svchost.exe 5 PID 284 wrote to memory of 368 284 svchost.exe 5 PID 284 wrote to memory of 368 284 svchost.exe 5 PID 284 wrote to memory of 368 284 svchost.exe 5 PID 284 wrote to memory of 368 284 svchost.exe 5 PID 284 wrote to memory of 380 284 svchost.exe 4 PID 284 wrote to memory of 380 284 svchost.exe 4 PID 284 wrote to memory of 380 284 svchost.exe 4 PID 284 wrote to memory of 380 284 svchost.exe 4 PID 284 wrote to memory of 380 284 svchost.exe 4 PID 284 wrote to memory of 416 284 svchost.exe 3 PID 284 wrote to memory of 416 284 svchost.exe 3 PID 284 wrote to memory of 416 284 svchost.exe 3 PID 284 wrote to memory of 416 284 svchost.exe 3 PID 284 wrote to memory of 416 284 svchost.exe 3 PID 284 wrote to memory of 464 284 svchost.exe 2 PID 284 wrote to memory of 464 284 svchost.exe 2 PID 284 wrote to memory of 464 284 svchost.exe 2 PID 284 wrote to memory of 464 284 svchost.exe 2
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:480
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:736
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1720
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1616
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1140
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1032
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:1000
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:108
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:856
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:832
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:792
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:660
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:580
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:380
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:488
-
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:332
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1284
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2abb45ab0e2c1482e7bd80909cb4ad6cf9a3fbfe67c7e1823204ebf663cc89ee.dll2⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2abb45ab0e2c1482e7bd80909cb4ad6cf9a3fbfe67c7e1823204ebf663cc89ee.dll3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\regsvr32mgr.exeC:\Windows\SysWOW64\regsvr32mgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1184
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:284
-
-
-
-
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:1196
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1096
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1228
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe1⤵PID:260
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD59d5d609dc8e2554054733d19eed45c5c
SHA1ce72453fca9f477940a9def32bd8463549c6e1e4
SHA2567a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1
SHA512012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b
-
Filesize
119KB
MD59d5d609dc8e2554054733d19eed45c5c
SHA1ce72453fca9f477940a9def32bd8463549c6e1e4
SHA2567a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1
SHA512012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b
-
Filesize
119KB
MD59d5d609dc8e2554054733d19eed45c5c
SHA1ce72453fca9f477940a9def32bd8463549c6e1e4
SHA2567a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1
SHA512012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b
-
Filesize
119KB
MD59d5d609dc8e2554054733d19eed45c5c
SHA1ce72453fca9f477940a9def32bd8463549c6e1e4
SHA2567a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1
SHA512012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b
-
Filesize
119KB
MD59d5d609dc8e2554054733d19eed45c5c
SHA1ce72453fca9f477940a9def32bd8463549c6e1e4
SHA2567a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1
SHA512012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b
-
Filesize
119KB
MD59d5d609dc8e2554054733d19eed45c5c
SHA1ce72453fca9f477940a9def32bd8463549c6e1e4
SHA2567a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1
SHA512012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b
-
Filesize
119KB
MD59d5d609dc8e2554054733d19eed45c5c
SHA1ce72453fca9f477940a9def32bd8463549c6e1e4
SHA2567a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1
SHA512012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b
-
Filesize
119KB
MD59d5d609dc8e2554054733d19eed45c5c
SHA1ce72453fca9f477940a9def32bd8463549c6e1e4
SHA2567a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1
SHA512012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b