Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
191s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe
-
Size
126KB
-
MD5
868cc39e6be8de942aeb91a0cd0f0e3a
-
SHA1
3454f00bc111f77f3e2eaf59a5701eee2812334c
-
SHA256
106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422
-
SHA512
b02cef21d0ea3fe70b6717771daba518fee3ff9c350999e1be71d856c899aae3e3ce482603e6a1dee2279ff77c857ac8bcfb41b22a584e87850aa22d3139c221
-
SSDEEP
3072:chQtGHhXy2F9RKMj4ZoPE17JaulUpCS/SGS:1uBy2F9zj4ZB1aul1
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" msiexec.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\2154318179 = "C:\\PROGRA~3\\msbbpsts.exe" msiexec.exe -
Blocklisted process makes network request 37 IoCs
flow pid Process 2 1272 msiexec.exe 3 1272 msiexec.exe 4 1272 msiexec.exe 6 1272 msiexec.exe 8 1272 msiexec.exe 10 1272 msiexec.exe 12 1272 msiexec.exe 14 1272 msiexec.exe 16 1272 msiexec.exe 18 1272 msiexec.exe 20 1272 msiexec.exe 22 1272 msiexec.exe 24 1272 msiexec.exe 26 1272 msiexec.exe 28 1272 msiexec.exe 30 1272 msiexec.exe 32 1272 msiexec.exe 34 1272 msiexec.exe 35 1272 msiexec.exe 36 1272 msiexec.exe 37 1272 msiexec.exe 38 1272 msiexec.exe 39 1272 msiexec.exe 40 1272 msiexec.exe 41 1272 msiexec.exe 42 1272 msiexec.exe 43 1272 msiexec.exe 44 1272 msiexec.exe 45 1272 msiexec.exe 46 1272 msiexec.exe 47 1272 msiexec.exe 48 1272 msiexec.exe 49 1272 msiexec.exe 50 1272 msiexec.exe 51 1272 msiexec.exe 52 1272 msiexec.exe 53 1272 msiexec.exe -
Disables taskbar notifications via registry modification
-
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\PROGRA~3\msbbpsts.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe 1272 msiexec.exe 1272 msiexec.exe -
Suspicious behavior: MapViewOfSection 26 IoCs
pid Process 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe 1272 msiexec.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1272 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe Token: SeBackupPrivilege 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe Token: SeRestorePrivilege 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe Token: SeDebugPrivilege 1272 msiexec.exe Token: SeBackupPrivilege 1272 msiexec.exe Token: SeRestorePrivilege 1272 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1548 wrote to memory of 1272 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe 28 PID 1548 wrote to memory of 1272 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe 28 PID 1548 wrote to memory of 1272 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe 28 PID 1548 wrote to memory of 1272 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe 28 PID 1548 wrote to memory of 1272 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe 28 PID 1548 wrote to memory of 1272 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe 28 PID 1548 wrote to memory of 1272 1548 106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe"C:\Users\Admin\AppData\Local\Temp\106efd72e024261d6071785c4d82e6960b43e4cf4b35f8ab27d3500e8cda8422.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1272
-