Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
169s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe
-
Size
2.1MB
-
MD5
ad4cece2d4b96eca82238a14e1cb80c2
-
SHA1
bf9c26ed312fa49e7699bf5c929516250d7840da
-
SHA256
c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b
-
SHA512
66d9859e2867f70b13857fd0899748e6357ce5a1f8d7ab8efb444480f2712e7a64619cf8d474ed799ae3696d273c3d28eb2fb586022c2d13deabb407a478ee9e
-
SSDEEP
49152:DpXUpXXPiR40wNKxC9Y5lpuGIPQxMXj8iuF2QJ4O8b8ITDnlv1:GgxC9Y5lpuG8D
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sychost.exe" c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinIcons = "C:\\Windows\\system32\\winicons.exe" reg.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\winicons.exe c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Windows\SysWOW64\winicons.exe c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File created C:\Windows\SysWOW64\sychost.exe c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 952 set thread context of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 -
Drops file in Program Files directory 58 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\bg.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\7zG.exe c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\History.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\7z.exe c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 1536 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 1536 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 1536 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 1536 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1564 explorer.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 1564 explorer.exe Token: SeShutdownPrivilege 1564 explorer.exe Token: SeShutdownPrivilege 1564 explorer.exe Token: SeShutdownPrivilege 1564 explorer.exe Token: SeShutdownPrivilege 1564 explorer.exe Token: SeShutdownPrivilege 1564 explorer.exe Token: SeShutdownPrivilege 1564 explorer.exe Token: SeShutdownPrivilege 1564 explorer.exe Token: SeShutdownPrivilege 1564 explorer.exe Token: SeShutdownPrivilege 1564 explorer.exe Token: 33 1224 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1224 AUDIODG.EXE Token: 33 1224 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1224 AUDIODG.EXE Token: SeShutdownPrivilege 1564 explorer.exe Token: SeShutdownPrivilege 1564 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe -
Suspicious use of SendNotifyMessage 22 IoCs
pid Process 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe 1564 explorer.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 952 wrote to memory of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 PID 952 wrote to memory of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 PID 952 wrote to memory of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 PID 952 wrote to memory of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 PID 952 wrote to memory of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 PID 952 wrote to memory of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 PID 952 wrote to memory of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 PID 952 wrote to memory of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 PID 952 wrote to memory of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 PID 952 wrote to memory of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 PID 952 wrote to memory of 1536 952 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 28 PID 1536 wrote to memory of 560 1536 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 30 PID 1536 wrote to memory of 560 1536 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 30 PID 1536 wrote to memory of 560 1536 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 30 PID 1536 wrote to memory of 560 1536 c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe 30 PID 560 wrote to memory of 1724 560 cmd.exe 32 PID 560 wrote to memory of 1724 560 cmd.exe 32 PID 560 wrote to memory of 1724 560 cmd.exe 32 PID 560 wrote to memory of 1724 560 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe"C:\Users\Admin\AppData\Local\Temp\c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exeC:\Users\Admin\AppData\Local\Temp\c905175af13ae804feba14d8983cf323da2bf44d6b6b391a82053b56bfafd79b.exe2⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v WinIcons /t REG_SZ /d C:\Windows\system32\winicons.exe /f3⤵
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\SysWOW64\reg.exereg ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v WinIcons /t REG_SZ /d C:\Windows\system32\winicons.exe /f4⤵
- Adds Run key to start application
PID:1724
-
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1564
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5a41⤵
- Suspicious use of AdjustPrivilegeToken
PID:1224