Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
184s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 05:06
Static task
static1
Behavioral task
behavioral1
Sample
93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe
Resource
win10v2004-20221111-en
General
-
Target
93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe
-
Size
138KB
-
MD5
da4f2c514e0d3bafb432c9e6a9ae13ed
-
SHA1
e43102428eb63d6d4995792a442dece79990b66b
-
SHA256
93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d
-
SHA512
658edf16d9121e9a4c34986b16e858e865e552ec67daf7386d9808b0165e1260485f7165416fa3f76227c674984807a0e15208fbad3c38b5069d45d199920a7a
-
SSDEEP
3072:KTg+x50VJqtHGbu5XCniylWrtGA1GHvGXaCH1Fukp1o2Yo3wQGr:KTLoGtmiYlW4A1QvGXjBonnQGr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1256 ukuw.exe -
Deletes itself 1 IoCs
pid Process 1088 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\Currentversion\Run ukuw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\{AFFAE1AF-D084-FDFA-038F-ECD0FAA11F92} = "C:\\Users\\Admin\\AppData\\Roaming\\Sone\\ukuw.exe" ukuw.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1260 set thread context of 1088 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 30 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Privacy 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\0F8B1F2B-00000001.eml:OECustomProperty WinMail.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe 1256 ukuw.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeSecurityPrivilege 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe Token: SeSecurityPrivilege 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe Token: SeSecurityPrivilege 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe Token: SeSecurityPrivilege 1088 cmd.exe Token: SeManageVolumePrivilege 992 WinMail.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 992 WinMail.exe -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 1260 wrote to memory of 1256 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 28 PID 1260 wrote to memory of 1256 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 28 PID 1260 wrote to memory of 1256 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 28 PID 1260 wrote to memory of 1256 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 28 PID 1256 wrote to memory of 1128 1256 ukuw.exe 18 PID 1256 wrote to memory of 1128 1256 ukuw.exe 18 PID 1256 wrote to memory of 1128 1256 ukuw.exe 18 PID 1256 wrote to memory of 1128 1256 ukuw.exe 18 PID 1256 wrote to memory of 1128 1256 ukuw.exe 18 PID 1256 wrote to memory of 1192 1256 ukuw.exe 19 PID 1256 wrote to memory of 1192 1256 ukuw.exe 19 PID 1256 wrote to memory of 1192 1256 ukuw.exe 19 PID 1256 wrote to memory of 1192 1256 ukuw.exe 19 PID 1256 wrote to memory of 1192 1256 ukuw.exe 19 PID 1256 wrote to memory of 1244 1256 ukuw.exe 20 PID 1256 wrote to memory of 1244 1256 ukuw.exe 20 PID 1256 wrote to memory of 1244 1256 ukuw.exe 20 PID 1256 wrote to memory of 1244 1256 ukuw.exe 20 PID 1256 wrote to memory of 1244 1256 ukuw.exe 20 PID 1256 wrote to memory of 1260 1256 ukuw.exe 27 PID 1256 wrote to memory of 1260 1256 ukuw.exe 27 PID 1256 wrote to memory of 1260 1256 ukuw.exe 27 PID 1256 wrote to memory of 1260 1256 ukuw.exe 27 PID 1256 wrote to memory of 1260 1256 ukuw.exe 27 PID 1256 wrote to memory of 992 1256 ukuw.exe 29 PID 1256 wrote to memory of 992 1256 ukuw.exe 29 PID 1256 wrote to memory of 992 1256 ukuw.exe 29 PID 1256 wrote to memory of 992 1256 ukuw.exe 29 PID 1256 wrote to memory of 992 1256 ukuw.exe 29 PID 1260 wrote to memory of 1088 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 30 PID 1260 wrote to memory of 1088 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 30 PID 1260 wrote to memory of 1088 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 30 PID 1260 wrote to memory of 1088 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 30 PID 1260 wrote to memory of 1088 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 30 PID 1260 wrote to memory of 1088 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 30 PID 1260 wrote to memory of 1088 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 30 PID 1260 wrote to memory of 1088 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 30 PID 1260 wrote to memory of 1088 1260 93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe 30 PID 1256 wrote to memory of 956 1256 ukuw.exe 31 PID 1256 wrote to memory of 956 1256 ukuw.exe 31 PID 1256 wrote to memory of 956 1256 ukuw.exe 31 PID 1256 wrote to memory of 956 1256 ukuw.exe 31 PID 1256 wrote to memory of 956 1256 ukuw.exe 31 PID 1256 wrote to memory of 1772 1256 ukuw.exe 32 PID 1256 wrote to memory of 1772 1256 ukuw.exe 32 PID 1256 wrote to memory of 1772 1256 ukuw.exe 32 PID 1256 wrote to memory of 1772 1256 ukuw.exe 32 PID 1256 wrote to memory of 1772 1256 ukuw.exe 32 PID 1256 wrote to memory of 1060 1256 ukuw.exe 33 PID 1256 wrote to memory of 1060 1256 ukuw.exe 33 PID 1256 wrote to memory of 1060 1256 ukuw.exe 33 PID 1256 wrote to memory of 1060 1256 ukuw.exe 33 PID 1256 wrote to memory of 1060 1256 ukuw.exe 33 PID 1256 wrote to memory of 1616 1256 ukuw.exe 34 PID 1256 wrote to memory of 1616 1256 ukuw.exe 34 PID 1256 wrote to memory of 1616 1256 ukuw.exe 34 PID 1256 wrote to memory of 1616 1256 ukuw.exe 34 PID 1256 wrote to memory of 1616 1256 ukuw.exe 34
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1192
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe"C:\Users\Admin\AppData\Local\Temp\93f8a146571dbe06d8b4c6df10a2637f3f0a4c408af5aa3574198174c9a9f10d.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Roaming\Sone\ukuw.exe"C:\Users\Admin\AppData\Roaming\Sone\ukuw.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1256
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp47863ad5.bat"3⤵
- Deletes itself
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:992
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-522998858-2100644627-1192300921-364256560-1724140054-1091759942-13410084001638321678"1⤵PID:956
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1772
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1060
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:1616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD5f45cf2d4b182f782cac028905f68e76c
SHA1ee773c97eadd8159d80941490c603d3390d6d901
SHA256f0bf06a23f1c5624c091152cb2aaf2fb08aa03ce406653f86c4ffd90e7869e56
SHA512a9393b98b4e6b8be267dcd1796c5ff1dcc65b58b71c3e93154877cee8d102404c647249ecb02e45c659391dbf095dca1c0c8b5f6a70fdf56506042c6ab777fdd
-
Filesize
138KB
MD5c154df8ce44d650748ac1a8a4677494e
SHA1442f71e52e30a24fed557ee836fd01d0d3cd8364
SHA2560604a20641c7249080fe5dc081c566d1492239a2a47ca2d803455c42adf359cf
SHA512c1c8a01cab0052f232b09e204a124e1a57c09ffc6343d918c6ddfb3a056fe7ce00b54324cdb64b159490ed489206054c3acd8d14c2af4c78687325fa5a18915b
-
Filesize
138KB
MD5c154df8ce44d650748ac1a8a4677494e
SHA1442f71e52e30a24fed557ee836fd01d0d3cd8364
SHA2560604a20641c7249080fe5dc081c566d1492239a2a47ca2d803455c42adf359cf
SHA512c1c8a01cab0052f232b09e204a124e1a57c09ffc6343d918c6ddfb3a056fe7ce00b54324cdb64b159490ed489206054c3acd8d14c2af4c78687325fa5a18915b
-
Filesize
398B
MD5de9dc45c45410b644d179f2a3d0b6760
SHA136867633f593e3532485937bec27d4828a2ce352
SHA2565223b0ebb956f414cce9ed2069278245c20e54083a5204fdb8cba52ac7a21aa9
SHA51293582280f45ca87b12a29ae9fea7de658e3f748222fa13a70a01443c8c6e7f0dcb7a015cdb8773c60f09a09c0911ff57043717f69ff8a9a94ac810cea5b3418a
-
Filesize
138KB
MD5c154df8ce44d650748ac1a8a4677494e
SHA1442f71e52e30a24fed557ee836fd01d0d3cd8364
SHA2560604a20641c7249080fe5dc081c566d1492239a2a47ca2d803455c42adf359cf
SHA512c1c8a01cab0052f232b09e204a124e1a57c09ffc6343d918c6ddfb3a056fe7ce00b54324cdb64b159490ed489206054c3acd8d14c2af4c78687325fa5a18915b
-
Filesize
138KB
MD5c154df8ce44d650748ac1a8a4677494e
SHA1442f71e52e30a24fed557ee836fd01d0d3cd8364
SHA2560604a20641c7249080fe5dc081c566d1492239a2a47ca2d803455c42adf359cf
SHA512c1c8a01cab0052f232b09e204a124e1a57c09ffc6343d918c6ddfb3a056fe7ce00b54324cdb64b159490ed489206054c3acd8d14c2af4c78687325fa5a18915b