Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

b7250785bb...48.exe

windows7-x64

8

b7250785bb...48.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    169s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 15:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b7250785bbcb7676b32f4d0dbca4bfb1ed4e0f84ad28a2bbac10b4c695cb5f48.exe

  • Size

    809KB

  • MD5

    9fa89d305d099f16e1fc13048efa6e98

  • SHA1

    3dca0f3ffe53c3a90d33d10ee9656407587b625f

  • SHA256

    b7250785bbcb7676b32f4d0dbca4bfb1ed4e0f84ad28a2bbac10b4c695cb5f48

  • SHA512

    5a7493cc56b634fea0d82c6cdaa0d88d51a77aa850e99a9494043df2bc06dfe55ab57913e038b1ad04330ec94aa1cae86dc412d504bec38c57f849a6c9527760

  • SSDEEP

    24576:n2Qoqtcz49Sznsb9q0wK6e9D08IxDL+dznt9103yv:lb849UnsJvzJnOnizntU3

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 45 IoCs
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7250785bbcb7676b32f4d0dbca4bfb1ed4e0f84ad28a2bbac10b4c695cb5f48.exe
    "C:\Users\Admin\AppData\Local\Temp\b7250785bbcb7676b32f4d0dbca4bfb1ed4e0f84ad28a2bbac10b4c695cb5f48.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\ProgramData\privacy.exe
      C:\ProgramData\privacy.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4936
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2116
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3776
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Modifies registry class
      PID:3660
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1364
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
    1⤵
      PID:2980
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:4992
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:5104
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Modifies registry class
        PID:2204
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4312
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Modifies registry class
        PID:4304

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\privacy.exe
      Filesize

      797KB

      MD5

      66efb21472b33a6229616869ad5f0724

      SHA1

      f7e64181a7ddccfc599952032a6b40e02e8e8681

      SHA256

      b64f7e0037e944e34a5b665ed3b3d4a64371f65a77ec0d2a9b007528cfd2cc1a

      SHA512

      1bdf5ac3e23027fdb0fdd7140accf36f12bfb99b7f08881aa29882ea00255255ce3aef450041a9e95d30513e8bf30895b99bfccbbf78923054dd2e5cd043d50d

      Download Submit

    • C:\ProgramData\privacy.exe
      Filesize

      797KB

      MD5

      66efb21472b33a6229616869ad5f0724

      SHA1

      f7e64181a7ddccfc599952032a6b40e02e8e8681

      SHA256

      b64f7e0037e944e34a5b665ed3b3d4a64371f65a77ec0d2a9b007528cfd2cc1a

      SHA512

      1bdf5ac3e23027fdb0fdd7140accf36f12bfb99b7f08881aa29882ea00255255ce3aef450041a9e95d30513e8bf30895b99bfccbbf78923054dd2e5cd043d50d

      Download Submit

    • C:\Users\Public\Desktop\Privacy Protection.lnk
      Filesize

      672B

      MD5

      3a91aa6d7c3cef909c9e0f90e107825f

      SHA1

      cf47e81035f61e3809129a04168d39b2ab6b704d

      SHA256

      0118917be48f42fe9e83e64f71a279c1aae2b058cc10d03ef146df39afebc9ec

      SHA512

      cccbed1fa9ebb9c15c6e08e9425fb3ebcadb3a40ebd27a62be277096d66c0021dfa4bc3920664624cd5e83b3ba61e590fc5dad055ab2944d81d6f5063c52fc54

      Download Submit

    • memory/4904-132-0x0000000000400000-0x00000000005E5000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/4904-136-0x0000000002390000-0x0000000002397000-memory.dmp

      Filesize

      28KB

      Download

    • memory/4936-138-0x0000000000400000-0x0000000000B0A000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/4936-140-0x0000000000400000-0x0000000000B0A000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/4936-137-0x0000000002860000-0x0000000002866000-memory.dmp

      Filesize

      24KB

      Download

    • memory/4936-144-0x0000000000400000-0x0000000000B0A000-memory.dmp

      Filesize

      7.0MB

      Download