Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
Resource
win10v2004-20221111-en
General
-
Target
2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe
-
Size
172KB
-
MD5
c06b551f110824f92f7dd6e1e286338b
-
SHA1
b1451aabe43b20ddfe11ba08cda0716a47cf9fe6
-
SHA256
0fdc5af087744ec47f94d6d98b05c2f018a5b16bb097a7826f096bc6f7ffd92f
-
SHA512
4ae0cee0c75e61be40d33635b658d3ea0e074b7f4246a037da60ee6075906583b532236e41e1a3910684b9d8b71fecbcdadc1f9249bacf94b7726818cfbdc576
-
SSDEEP
3072:Lw0CwITzueTD9d0h06Up164tnYx82gGtjdkruyjn:LwYuzue/9+hpK8i4IGtj4
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1276 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1484 set thread context of 1688 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 27 -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 1688 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 1688 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE 1424 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1424 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1688 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe Token: SeDebugPrivilege 1424 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1424 Explorer.EXE 1424 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1424 Explorer.EXE 1424 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1424 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1484 wrote to memory of 1688 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 27 PID 1484 wrote to memory of 1688 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 27 PID 1484 wrote to memory of 1688 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 27 PID 1484 wrote to memory of 1688 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 27 PID 1484 wrote to memory of 1688 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 27 PID 1484 wrote to memory of 1688 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 27 PID 1484 wrote to memory of 1688 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 27 PID 1484 wrote to memory of 1688 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 27 PID 1484 wrote to memory of 1688 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 27 PID 1484 wrote to memory of 1688 1484 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 27 PID 1688 wrote to memory of 1276 1688 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 28 PID 1688 wrote to memory of 1276 1688 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 28 PID 1688 wrote to memory of 1276 1688 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 28 PID 1688 wrote to memory of 1276 1688 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 28 PID 1688 wrote to memory of 1424 1688 2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe 13 PID 1424 wrote to memory of 1280 1424 Explorer.EXE 15 PID 1424 wrote to memory of 1396 1424 Explorer.EXE 14
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe"C:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exeC:\Users\Admin\AppData\Local\Temp\2014_11_transaktions_id_000000039190_de_398000283221_0033565020_029389227_92_200001.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS3818~1.BAT"4⤵
- Deletes itself
PID:1276
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1396
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1280
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201B
MD55891d3036c8dbf331b5a34395e4b81e0
SHA1446fc77adf2ed4b0d99dade53fac522dea014a54
SHA256e2b6c26f7868bc0b39128e531e8b87f73431ef1c4d8aa7be9014ffbda83dfdbf
SHA5126f7c171e925e0672347ae4f56646f64d42229b18f43531de7708baf8ad3a2a00a77681c606690c845e7cf7e4539aa86ecc1cc4f992d8adea0c30492e5589d371