Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 14:53
Static task
static1
Behavioral task
behavioral1
Sample
d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe
-
Size
250KB
-
MD5
6c4899330d4276d579a5282d8a6958c4
-
SHA1
537542e9611a142870f4738e6dba690a21bca459
-
SHA256
d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972
-
SHA512
b1b34fcfa634496c96333a05e91244af543ac2bfe12ae59dd99372f627c34c1997affbf955a6049dca606714f654b908182b7b09f35abf66f8150425730f258f
-
SSDEEP
3072:+9SojmNgurSrEt2fOp8TXhOrGM1OJSawFjUK/I0N7xy6T+3wpQ2LaM:yxRurSTy8zhZYCD34y6TJpP
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{C453F4D7-0B5D-4B3D-B57F-2BE93BB3BC7B}\\f5ea51da.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{C453F4D7-0B5D-4B3D-B57F-2BE93BB3BC7B}\\f5ea51da.exe" explorer.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1692 set thread context of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe -
Suspicious behavior: MapViewOfSection 26 IoCs
pid Process 1708 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 1708 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe 1996 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeDebugPrivilege 1996 explorer.exe Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeSystemtimePrivilege 872 Process not Found Token: SeBackupPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeShutdownPrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeUndockPrivilege 872 Process not Found Token: SeManageVolumePrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1384 Process not Found 1384 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1384 Process not Found 1384 Process not Found -
Suspicious use of UnmapMainImage 6 IoCs
pid Process 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1892 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 28 PID 1692 wrote to memory of 1892 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 28 PID 1692 wrote to memory of 1892 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 28 PID 1692 wrote to memory of 1892 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 28 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1692 wrote to memory of 1708 1692 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 29 PID 1708 wrote to memory of 1996 1708 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 30 PID 1708 wrote to memory of 1996 1708 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 30 PID 1708 wrote to memory of 1996 1708 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 30 PID 1708 wrote to memory of 1996 1708 d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe"C:\Users\Admin\AppData\Local\Temp\d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe"C:\Users\Admin\AppData\Local\Temp\d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe"2⤵PID:1892
-
-
C:\Users\Admin\AppData\Local\Temp\d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe"C:\Users\Admin\AppData\Local\Temp\d47b36c2fc5731e1fd4360595f608277579df21102712e048023bf7bb2226972.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-