Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
176s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 09:02
Static task
static1
Behavioral task
behavioral1
Sample
e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe
Resource
win10v2004-20221111-en
General
-
Target
e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe
-
Size
130KB
-
MD5
5bb16aa83e702f599f521c89bbfc6706
-
SHA1
2a1527ccd4d4a667fcebd1a948bd6a31d4fb4629
-
SHA256
e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa
-
SHA512
584dd5bc163b54661a2141b2db3312c1476b7f15babe3478abd7e18e269dc83dce7df19f4c515e91d12c0d42596579eb11f54ac40df98535158d6e5ef479eceb
-
SSDEEP
3072:3dK5fyVxt6jznO7P/3Qimke50bTc26K49h28uS:3s1OP/3Qimk/fcNvh28f
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wino32_trxo.vbs e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windm32_thc = "C:\\Program Files\\Winmows Publhc\\services.exe" regedit.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\2.txt e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe File created C:\Windows\SysWOW64\1.txt e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe File opened for modification C:\Windows\SysWOW64\1.txt e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe File opened for modification C:\Windows\SysWOW64\internat.exe.txt e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe File opened for modification C:\Windows\SysWOW64\internat.exe e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Winmows Publhc\services.exe.txt e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe File opened for modification C:\Program Files\Winmows Publhc\services.exe e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe -
Kills process with taskkill 3 IoCs
pid Process 3008 taskkill.exe 1232 taskkill.exe 5024 taskkill.exe -
Runs .reg file with regedit 1 IoCs
pid Process 1568 regedit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1232 taskkill.exe Token: SeDebugPrivilege 5024 taskkill.exe Token: SeDebugPrivilege 3008 taskkill.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 1220 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 1220 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 1220 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1232 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 83 PID 1984 wrote to memory of 1232 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 83 PID 1984 wrote to memory of 1232 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 83 PID 1984 wrote to memory of 1220 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 84 PID 1984 wrote to memory of 1220 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 84 PID 1984 wrote to memory of 1220 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 84 PID 1984 wrote to memory of 5024 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 87 PID 1984 wrote to memory of 5024 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 87 PID 1984 wrote to memory of 5024 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 87 PID 1984 wrote to memory of 3008 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 89 PID 1984 wrote to memory of 3008 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 89 PID 1984 wrote to memory of 3008 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 89 PID 1984 wrote to memory of 1568 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 94 PID 1984 wrote to memory of 1568 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 94 PID 1984 wrote to memory of 1568 1984 e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe"C:\Users\Admin\AppData\Local\Temp\e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe"1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /im iResearchiClick.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1232
-
-
C:\Users\Admin\AppData\Local\Temp\e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exeC:\Users\Admin\AppData\Local\Temp\e42f6dd08dffb9cc32ec8392b614592a5e056bb7a9e81f4dfe5758b12dcbf7aa.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:1220
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /im internat.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /im internat.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s C:\1.reg2⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:1568
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171B
MD5371f0901bdf322834c33882bb4948bdc
SHA18aa342e78b3ba40569fec467f92e22a3b612c9e9
SHA2564ad2483a1312d5ec44ce7aa920815a7debd41a4c6d5347dbc4999cb580220b75
SHA512135f3d74cd1df0bffde238901e9e9ffa55ae039db66f5beae2977acddf79ef86b217324b741533b6e1860d480917060412bf15b6b1f3038c2229c282855ed96e