Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe
Resource
win10v2004-20220812-en
General
-
Target
d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe
-
Size
478KB
-
MD5
f7e1a441315a80328596c03da48d1778
-
SHA1
892ec2afe8549bc85d323ce9cfef1e08873ae7a0
-
SHA256
d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30
-
SHA512
ee03790b38b8986739cfda71d4cd12fee0802ae13cb11aeb59c5bdbc249aa363e281014a3da8a2f36615c34f7d6559d82035dc3432145e01e354d64f75063ab4
-
SSDEEP
6144:0APTi7C55DbmAs2X/4UYPOHfDLmmhDOnzYMvDfDllEVMSjFd+v:7WK5/aq4UYPOugOnEADf7g
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 1644 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 1520 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe -
Deletes itself 1 IoCs
pid Process 868 cmd.exe -
Loads dropped DLL 4 IoCs
pid Process 1608 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 1608 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Local\\Windows32\\Explorer.exe" d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\\Windows32\\Explorer.exe" d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1752 set thread context of 1608 1752 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 28 PID 468 set thread context of 1520 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1812 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1520 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1752 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe Token: SeDebugPrivilege 1608 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe Token: SeDebugPrivilege 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe Token: SeDebugPrivilege 1520 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe Token: SeDebugPrivilege 1520 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1520 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1608 1752 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 28 PID 1752 wrote to memory of 1608 1752 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 28 PID 1752 wrote to memory of 1608 1752 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 28 PID 1752 wrote to memory of 1608 1752 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 28 PID 1752 wrote to memory of 1608 1752 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 28 PID 1752 wrote to memory of 1608 1752 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 28 PID 1752 wrote to memory of 1608 1752 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 28 PID 1752 wrote to memory of 1608 1752 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 28 PID 1752 wrote to memory of 1608 1752 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 28 PID 1608 wrote to memory of 468 1608 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 29 PID 1608 wrote to memory of 468 1608 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 29 PID 1608 wrote to memory of 468 1608 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 29 PID 1608 wrote to memory of 468 1608 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 29 PID 1608 wrote to memory of 868 1608 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 30 PID 1608 wrote to memory of 868 1608 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 30 PID 1608 wrote to memory of 868 1608 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 30 PID 1608 wrote to memory of 868 1608 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 30 PID 868 wrote to memory of 1812 868 cmd.exe 32 PID 868 wrote to memory of 1812 868 cmd.exe 32 PID 868 wrote to memory of 1812 868 cmd.exe 32 PID 868 wrote to memory of 1812 868 cmd.exe 32 PID 468 wrote to memory of 1644 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 33 PID 468 wrote to memory of 1644 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 33 PID 468 wrote to memory of 1644 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 33 PID 468 wrote to memory of 1644 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 33 PID 468 wrote to memory of 1520 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 34 PID 468 wrote to memory of 1520 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 34 PID 468 wrote to memory of 1520 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 34 PID 468 wrote to memory of 1520 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 34 PID 468 wrote to memory of 1520 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 34 PID 468 wrote to memory of 1520 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 34 PID 468 wrote to memory of 1520 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 34 PID 468 wrote to memory of 1520 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 34 PID 468 wrote to memory of 1520 468 d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe"C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe"C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe"C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe"C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe"4⤵
- Executes dropped EXE
PID:1644
-
-
C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe"C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10004⤵
- Runs ping.exe
PID:1812
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe
Filesize478KB
MD5f7e1a441315a80328596c03da48d1778
SHA1892ec2afe8549bc85d323ce9cfef1e08873ae7a0
SHA256d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30
SHA512ee03790b38b8986739cfda71d4cd12fee0802ae13cb11aeb59c5bdbc249aa363e281014a3da8a2f36615c34f7d6559d82035dc3432145e01e354d64f75063ab4
-
C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe
Filesize478KB
MD5f7e1a441315a80328596c03da48d1778
SHA1892ec2afe8549bc85d323ce9cfef1e08873ae7a0
SHA256d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30
SHA512ee03790b38b8986739cfda71d4cd12fee0802ae13cb11aeb59c5bdbc249aa363e281014a3da8a2f36615c34f7d6559d82035dc3432145e01e354d64f75063ab4
-
C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe
Filesize478KB
MD5f7e1a441315a80328596c03da48d1778
SHA1892ec2afe8549bc85d323ce9cfef1e08873ae7a0
SHA256d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30
SHA512ee03790b38b8986739cfda71d4cd12fee0802ae13cb11aeb59c5bdbc249aa363e281014a3da8a2f36615c34f7d6559d82035dc3432145e01e354d64f75063ab4
-
C:\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe
Filesize478KB
MD5f7e1a441315a80328596c03da48d1778
SHA1892ec2afe8549bc85d323ce9cfef1e08873ae7a0
SHA256d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30
SHA512ee03790b38b8986739cfda71d4cd12fee0802ae13cb11aeb59c5bdbc249aa363e281014a3da8a2f36615c34f7d6559d82035dc3432145e01e354d64f75063ab4
-
\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe
Filesize478KB
MD5f7e1a441315a80328596c03da48d1778
SHA1892ec2afe8549bc85d323ce9cfef1e08873ae7a0
SHA256d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30
SHA512ee03790b38b8986739cfda71d4cd12fee0802ae13cb11aeb59c5bdbc249aa363e281014a3da8a2f36615c34f7d6559d82035dc3432145e01e354d64f75063ab4
-
\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe
Filesize478KB
MD5f7e1a441315a80328596c03da48d1778
SHA1892ec2afe8549bc85d323ce9cfef1e08873ae7a0
SHA256d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30
SHA512ee03790b38b8986739cfda71d4cd12fee0802ae13cb11aeb59c5bdbc249aa363e281014a3da8a2f36615c34f7d6559d82035dc3432145e01e354d64f75063ab4
-
\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe
Filesize478KB
MD5f7e1a441315a80328596c03da48d1778
SHA1892ec2afe8549bc85d323ce9cfef1e08873ae7a0
SHA256d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30
SHA512ee03790b38b8986739cfda71d4cd12fee0802ae13cb11aeb59c5bdbc249aa363e281014a3da8a2f36615c34f7d6559d82035dc3432145e01e354d64f75063ab4
-
\Users\Admin\AppData\Local\Temp\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30\d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30.exe
Filesize478KB
MD5f7e1a441315a80328596c03da48d1778
SHA1892ec2afe8549bc85d323ce9cfef1e08873ae7a0
SHA256d4c1fbc3ff3b1c1d7a33bb65bb1055b72de205d5a8ce889759b744663ee9ac30
SHA512ee03790b38b8986739cfda71d4cd12fee0802ae13cb11aeb59c5bdbc249aa363e281014a3da8a2f36615c34f7d6559d82035dc3432145e01e354d64f75063ab4