Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
188s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 22:23
Static task
static1
Behavioral task
behavioral1
Sample
547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe
Resource
win10v2004-20221111-en
General
-
Target
547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe
-
Size
460KB
-
MD5
42ea65ffc61947188cdb79cd9c0daf69
-
SHA1
6de811d563fb014b847319e525f0abb2b33e1691
-
SHA256
547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848
-
SHA512
f92e902eff76b4b2f46d278f8b0a1eb41d9beec6fcb010b8a1bf2c1269de9e0fcb8ae9d027a18e457eeca47079469022b842207934a952bde0fadfa83408e1c1
-
SSDEEP
12288:+sAw9HD4XRhlitra71HPVzRZvZlk7Mb3c/M7aYz3SaQOEXsasmgQBoVR/uZ:DuvlitqptRbB
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1040 MNnvyTciUUCUUeH.exe -
Deletes itself 1 IoCs
pid Process 1040 MNnvyTciUUCUUeH.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 icanhazip.com -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\f5e83w4ef.dat Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\f5e83w4ef.dat Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Process not Found File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0SMVW5K9.txt Process not Found -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\MNnvyTciUUCUUeH.exe 547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe -
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96} Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96}\WpadDecisionReason = "1" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96}\WpadDecisionTime = f08d3f028a03d901 Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Process not Found Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Process not Found Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-6a-f5-61-2a-69 Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-6a-f5-61-2a-69\WpadDecisionReason = "1" Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-6a-f5-61-2a-69\WpadDecision = "0" Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96}\WpadNetworkName = "Network 2" Process not Found Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96}\5e-6a-f5-61-2a-69 Process not Found Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-6a-f5-61-2a-69\WpadDecisionTime = f08d3f028a03d901 Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96}\WpadDecision = "0" Process not Found -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1828 547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe 1040 MNnvyTciUUCUUeH.exe 1040 MNnvyTciUUCUUeH.exe 1040 MNnvyTciUUCUUeH.exe 584 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1040 MNnvyTciUUCUUeH.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1828 547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe Token: SeDebugPrivilege 1040 MNnvyTciUUCUUeH.exe Token: SeDebugPrivilege 584 Process not Found -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1828 547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe 1040 MNnvyTciUUCUUeH.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1828 wrote to memory of 1040 1828 547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe 28 PID 1828 wrote to memory of 1040 1828 547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe 28 PID 1828 wrote to memory of 1040 1828 547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe 28 PID 1828 wrote to memory of 1040 1828 547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe"C:\Users\Admin\AppData\Local\Temp\547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\MNnvyTciUUCUUeH.exeC:\Users\Admin\AppData\Local\Temp\547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe2⤵
- Executes dropped EXE
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:1040
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
460KB
MD542ea65ffc61947188cdb79cd9c0daf69
SHA16de811d563fb014b847319e525f0abb2b33e1691
SHA256547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848
SHA512f92e902eff76b4b2f46d278f8b0a1eb41d9beec6fcb010b8a1bf2c1269de9e0fcb8ae9d027a18e457eeca47079469022b842207934a952bde0fadfa83408e1c1