Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
109s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe
Resource
win10v2004-20220812-en
General
-
Target
4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe
-
Size
846KB
-
MD5
6edcedb37a7430c85e0899fe50da8d40
-
SHA1
dcf0296a6106294af96e5f914c173aa664d0fb96
-
SHA256
4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec
-
SHA512
b68c0531ac3cdb9bedafe235ff0fde2f14080a6d1038749fa4a75bf512e40fe016f5589f7bec751588f1d5616f1f2600ccc362a53aadf6d4f217cc928ca5f3c7
-
SSDEEP
6144:jPavkfCnpdseVsDL5jxgcYORITHGi2oBsj:jPaxpyeVsf5SczOp2oB2
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\34294 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mseiviaxq.exe" svchost.exe -
Executes dropped EXE 3 IoCs
pid Process 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 52708 msiexec.exe 58488 msiexec.exe -
Loads dropped DLL 9 IoCs
pid Process 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 52708 msiexec.exe 52708 msiexec.exe 58488 msiexec.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum msiexec.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 msiexec.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1364 set thread context of 52608 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 28 PID 52708 set thread context of 58488 52708 msiexec.exe 30 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\mseiviaxq.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 52708 msiexec.exe 58488 msiexec.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 58488 msiexec.exe 58488 msiexec.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1364 wrote to memory of 52608 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 28 PID 1364 wrote to memory of 52608 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 28 PID 1364 wrote to memory of 52608 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 28 PID 1364 wrote to memory of 52608 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 28 PID 1364 wrote to memory of 52608 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 28 PID 1364 wrote to memory of 52608 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 28 PID 1364 wrote to memory of 52608 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 28 PID 1364 wrote to memory of 52608 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 28 PID 1364 wrote to memory of 52608 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 28 PID 1364 wrote to memory of 52608 1364 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 28 PID 52608 wrote to memory of 52708 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 29 PID 52608 wrote to memory of 52708 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 29 PID 52608 wrote to memory of 52708 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 29 PID 52608 wrote to memory of 52708 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 29 PID 52608 wrote to memory of 52708 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 29 PID 52608 wrote to memory of 52708 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 29 PID 52608 wrote to memory of 52708 52608 4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe 29 PID 52708 wrote to memory of 58488 52708 msiexec.exe 30 PID 52708 wrote to memory of 58488 52708 msiexec.exe 30 PID 52708 wrote to memory of 58488 52708 msiexec.exe 30 PID 52708 wrote to memory of 58488 52708 msiexec.exe 30 PID 52708 wrote to memory of 58488 52708 msiexec.exe 30 PID 52708 wrote to memory of 58488 52708 msiexec.exe 30 PID 52708 wrote to memory of 58488 52708 msiexec.exe 30 PID 52708 wrote to memory of 58488 52708 msiexec.exe 30 PID 52708 wrote to memory of 58488 52708 msiexec.exe 30 PID 58488 wrote to memory of 58536 58488 msiexec.exe 31 PID 58488 wrote to memory of 58536 58488 msiexec.exe 31 PID 58488 wrote to memory of 58536 58488 msiexec.exe 31 PID 58488 wrote to memory of 58536 58488 msiexec.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe"C:\Users\Admin\AppData\Local\Temp\4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe"C:\Users\Admin\AppData\Local\Temp\4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:52608 -
C:\Users\Admin\AppData\Local\Temp\_install_\msiexec.exe"C:\Users\Admin\AppData\Local\Temp\_install_\msiexec.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:52708 -
C:\Users\Admin\AppData\Local\Temp\_install_\msiexec.exe"C:\Users\Admin\AppData\Local\Temp\_install_\msiexec.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:58488 -
C:\Windows\syswow64\svchost.exeC:\Windows\syswow64\svchost.exe5⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
PID:58536
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe
Filesize846KB
MD56edcedb37a7430c85e0899fe50da8d40
SHA1dcf0296a6106294af96e5f914c173aa664d0fb96
SHA2564c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec
SHA512b68c0531ac3cdb9bedafe235ff0fde2f14080a6d1038749fa4a75bf512e40fe016f5589f7bec751588f1d5616f1f2600ccc362a53aadf6d4f217cc928ca5f3c7
-
Filesize
134KB
MD5a84c15fb551aa1de0ff9af31f4cad0f6
SHA1d0ad2854e9a42545619de2259f9f3f16fee40981
SHA2563da8793008f61850e110b2e041fa2333e8bb37cc840c95cec4312801b14e6d26
SHA512733887e1e915ca622763733e5a12bb21d2636948d3b541ef1f25172aa53a8cbfbba9abc818a7d618fc4aa1fc1ae759e904df15e86e9d33e9097c373e18b166b7
-
Filesize
134KB
MD5a84c15fb551aa1de0ff9af31f4cad0f6
SHA1d0ad2854e9a42545619de2259f9f3f16fee40981
SHA2563da8793008f61850e110b2e041fa2333e8bb37cc840c95cec4312801b14e6d26
SHA512733887e1e915ca622763733e5a12bb21d2636948d3b541ef1f25172aa53a8cbfbba9abc818a7d618fc4aa1fc1ae759e904df15e86e9d33e9097c373e18b166b7
-
Filesize
134KB
MD5a84c15fb551aa1de0ff9af31f4cad0f6
SHA1d0ad2854e9a42545619de2259f9f3f16fee40981
SHA2563da8793008f61850e110b2e041fa2333e8bb37cc840c95cec4312801b14e6d26
SHA512733887e1e915ca622763733e5a12bb21d2636948d3b541ef1f25172aa53a8cbfbba9abc818a7d618fc4aa1fc1ae759e904df15e86e9d33e9097c373e18b166b7
-
\Users\Admin\AppData\Local\Temp\4c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec.exe
Filesize846KB
MD56edcedb37a7430c85e0899fe50da8d40
SHA1dcf0296a6106294af96e5f914c173aa664d0fb96
SHA2564c4c5c5e1fd71b82b2f2cd497c4241b2b776635de4d899c281f3cb8157e109ec
SHA512b68c0531ac3cdb9bedafe235ff0fde2f14080a6d1038749fa4a75bf512e40fe016f5589f7bec751588f1d5616f1f2600ccc362a53aadf6d4f217cc928ca5f3c7
-
Filesize
134KB
MD5a84c15fb551aa1de0ff9af31f4cad0f6
SHA1d0ad2854e9a42545619de2259f9f3f16fee40981
SHA2563da8793008f61850e110b2e041fa2333e8bb37cc840c95cec4312801b14e6d26
SHA512733887e1e915ca622763733e5a12bb21d2636948d3b541ef1f25172aa53a8cbfbba9abc818a7d618fc4aa1fc1ae759e904df15e86e9d33e9097c373e18b166b7
-
Filesize
134KB
MD5a84c15fb551aa1de0ff9af31f4cad0f6
SHA1d0ad2854e9a42545619de2259f9f3f16fee40981
SHA2563da8793008f61850e110b2e041fa2333e8bb37cc840c95cec4312801b14e6d26
SHA512733887e1e915ca622763733e5a12bb21d2636948d3b541ef1f25172aa53a8cbfbba9abc818a7d618fc4aa1fc1ae759e904df15e86e9d33e9097c373e18b166b7
-
Filesize
134KB
MD5a84c15fb551aa1de0ff9af31f4cad0f6
SHA1d0ad2854e9a42545619de2259f9f3f16fee40981
SHA2563da8793008f61850e110b2e041fa2333e8bb37cc840c95cec4312801b14e6d26
SHA512733887e1e915ca622763733e5a12bb21d2636948d3b541ef1f25172aa53a8cbfbba9abc818a7d618fc4aa1fc1ae759e904df15e86e9d33e9097c373e18b166b7
-
Filesize
134KB
MD5a84c15fb551aa1de0ff9af31f4cad0f6
SHA1d0ad2854e9a42545619de2259f9f3f16fee40981
SHA2563da8793008f61850e110b2e041fa2333e8bb37cc840c95cec4312801b14e6d26
SHA512733887e1e915ca622763733e5a12bb21d2636948d3b541ef1f25172aa53a8cbfbba9abc818a7d618fc4aa1fc1ae759e904df15e86e9d33e9097c373e18b166b7
-
Filesize
134KB
MD5a84c15fb551aa1de0ff9af31f4cad0f6
SHA1d0ad2854e9a42545619de2259f9f3f16fee40981
SHA2563da8793008f61850e110b2e041fa2333e8bb37cc840c95cec4312801b14e6d26
SHA512733887e1e915ca622763733e5a12bb21d2636948d3b541ef1f25172aa53a8cbfbba9abc818a7d618fc4aa1fc1ae759e904df15e86e9d33e9097c373e18b166b7
-
Filesize
134KB
MD5a84c15fb551aa1de0ff9af31f4cad0f6
SHA1d0ad2854e9a42545619de2259f9f3f16fee40981
SHA2563da8793008f61850e110b2e041fa2333e8bb37cc840c95cec4312801b14e6d26
SHA512733887e1e915ca622763733e5a12bb21d2636948d3b541ef1f25172aa53a8cbfbba9abc818a7d618fc4aa1fc1ae759e904df15e86e9d33e9097c373e18b166b7
-
Filesize
134KB
MD5a84c15fb551aa1de0ff9af31f4cad0f6
SHA1d0ad2854e9a42545619de2259f9f3f16fee40981
SHA2563da8793008f61850e110b2e041fa2333e8bb37cc840c95cec4312801b14e6d26
SHA512733887e1e915ca622763733e5a12bb21d2636948d3b541ef1f25172aa53a8cbfbba9abc818a7d618fc4aa1fc1ae759e904df15e86e9d33e9097c373e18b166b7
-
Filesize
134KB
MD5a84c15fb551aa1de0ff9af31f4cad0f6
SHA1d0ad2854e9a42545619de2259f9f3f16fee40981
SHA2563da8793008f61850e110b2e041fa2333e8bb37cc840c95cec4312801b14e6d26
SHA512733887e1e915ca622763733e5a12bb21d2636948d3b541ef1f25172aa53a8cbfbba9abc818a7d618fc4aa1fc1ae759e904df15e86e9d33e9097c373e18b166b7