Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/11/2022, 04:28

General

  • Target

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f.exe

  • Size

    64KB

  • MD5

    03e13550b26710d712c55f4f109c46f8

  • SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

  • SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

  • SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • SSDEEP

    768:J4JPHOF3W8nMIbk6KQVEs8rA7FYM9M6Ap9riiJoqNGoLpPQA+yw/:J4Jf83W8W60IL26Ap8iJvGo96F/

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 16 IoCs
  • Drops file in System32 directory 12 IoCs
  • Drops file in Windows directory 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f.exe
    "C:\Users\Admin\AppData\Local\Temp\caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4088
    • C:\Windows\system\Fun.exe
      C:\Windows\system\Fun.exe
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Windows\SVIQ.EXE
        C:\Windows\SVIQ.EXE
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4208
    • C:\Windows\dc.exe
      C:\Windows\dc.exe
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:5020

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Help\Other.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\Help\Other.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\Help\Other.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\SVIQ.EXE

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\SVIQ.EXE

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\SVIQ.EXE

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\SysWOW64\WinSit.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\SysWOW64\WinSit.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\SysWOW64\config\Win.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\SysWOW64\config\Win.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\System\Fun.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\dc.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\dc.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\dc.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\dc.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\inf\Other.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\inf\Other.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\system\Fun.exe

    Filesize

    64KB

    MD5

    03e13550b26710d712c55f4f109c46f8

    SHA1

    66c84d55c674038b69a18f6260b6a8fc5f3983d9

    SHA256

    caab843ec14f8f9f5f5866e6a8d363c9afd40efb5a7e2c04bc4b7df2043bb08f

    SHA512

    7a1cdd0aa4e1825bf2962fde920a867a82a4a5a4eb2de6dd8f395d85d41560fbd331077524716dd5038d8cb8ee847c9eac2e6bd713c56e1e2b243befebd539d8

  • C:\Windows\wininit.ini

    Filesize

    41B

    MD5

    e839977c0d22c9aa497b0b1d90d8a372

    SHA1

    b5048e501399138796b38f3d3666e1a88c397e83

    SHA256

    478db7f82fd7ef4860f7acd2f534ec303175500d7f4e1e36161d31c900d234e2

    SHA512

    4c8ba5a26b6f738f8d25c32d019cee63e9a32d28e3aeb8fe31b965d7603c24a3539e469c8eb569747b47dadc9c43cdd1066ddb37ed8138bee5d0c74b5d0c275d

  • C:\Windows\wininit.ini

    Filesize

    41B

    MD5

    e839977c0d22c9aa497b0b1d90d8a372

    SHA1

    b5048e501399138796b38f3d3666e1a88c397e83

    SHA256

    478db7f82fd7ef4860f7acd2f534ec303175500d7f4e1e36161d31c900d234e2

    SHA512

    4c8ba5a26b6f738f8d25c32d019cee63e9a32d28e3aeb8fe31b965d7603c24a3539e469c8eb569747b47dadc9c43cdd1066ddb37ed8138bee5d0c74b5d0c275d