Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
178s -
max time network
215s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 01:51
Static task
static1
Behavioral task
behavioral1
Sample
85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe
Resource
win10v2004-20220812-en
General
-
Target
85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe
-
Size
253KB
-
MD5
70b2911cee828ed477d951a981657612
-
SHA1
5559510894e94c2c055c13dfa8c468ce48595fd6
-
SHA256
85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a
-
SHA512
a7dc706ad86e1ad73c0cf86350070ad0e6cf5e9baddebc92477e4dced1718d7e51dd4c4ece58e5ad279f759af805a2bb92a3fe40f54d28959ffe1fd2b759ffd9
-
SSDEEP
3072:1QPtaJwQWxmTe7dFVyUIYqiyeeWMIILPnBEhjQBNCSanYyZgpJnTsqnbaldBYhi1:+1aJ3WVdFQL1TTOFQBNE5ZgLnTnWP53/
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 268 nawe.exe 1468 nawe.exe -
Deletes itself 1 IoCs
pid Process 1812 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\Currentversion\Run nawe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ciibwy = "C:\\Users\\Admin\\AppData\\Roaming\\Icduer\\nawe.exe" nawe.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1108 set thread context of 864 1108 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 28 PID 268 set thread context of 1468 268 nawe.exe 30 -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe 1468 nawe.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe Token: SeSecurityPrivilege 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 1108 wrote to memory of 864 1108 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 28 PID 1108 wrote to memory of 864 1108 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 28 PID 1108 wrote to memory of 864 1108 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 28 PID 1108 wrote to memory of 864 1108 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 28 PID 1108 wrote to memory of 864 1108 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 28 PID 1108 wrote to memory of 864 1108 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 28 PID 1108 wrote to memory of 864 1108 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 28 PID 1108 wrote to memory of 864 1108 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 28 PID 1108 wrote to memory of 864 1108 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 28 PID 864 wrote to memory of 268 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 29 PID 864 wrote to memory of 268 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 29 PID 864 wrote to memory of 268 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 29 PID 864 wrote to memory of 268 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 29 PID 268 wrote to memory of 1468 268 nawe.exe 30 PID 268 wrote to memory of 1468 268 nawe.exe 30 PID 268 wrote to memory of 1468 268 nawe.exe 30 PID 268 wrote to memory of 1468 268 nawe.exe 30 PID 268 wrote to memory of 1468 268 nawe.exe 30 PID 268 wrote to memory of 1468 268 nawe.exe 30 PID 268 wrote to memory of 1468 268 nawe.exe 30 PID 268 wrote to memory of 1468 268 nawe.exe 30 PID 268 wrote to memory of 1468 268 nawe.exe 30 PID 1468 wrote to memory of 1132 1468 nawe.exe 17 PID 1468 wrote to memory of 1132 1468 nawe.exe 17 PID 1468 wrote to memory of 1132 1468 nawe.exe 17 PID 1468 wrote to memory of 1132 1468 nawe.exe 17 PID 1468 wrote to memory of 1132 1468 nawe.exe 17 PID 1468 wrote to memory of 1192 1468 nawe.exe 16 PID 1468 wrote to memory of 1192 1468 nawe.exe 16 PID 1468 wrote to memory of 1192 1468 nawe.exe 16 PID 1468 wrote to memory of 1192 1468 nawe.exe 16 PID 1468 wrote to memory of 1192 1468 nawe.exe 16 PID 1468 wrote to memory of 1268 1468 nawe.exe 15 PID 1468 wrote to memory of 1268 1468 nawe.exe 15 PID 1468 wrote to memory of 1268 1468 nawe.exe 15 PID 1468 wrote to memory of 1268 1468 nawe.exe 15 PID 1468 wrote to memory of 1268 1468 nawe.exe 15 PID 1468 wrote to memory of 864 1468 nawe.exe 28 PID 1468 wrote to memory of 864 1468 nawe.exe 28 PID 1468 wrote to memory of 864 1468 nawe.exe 28 PID 1468 wrote to memory of 864 1468 nawe.exe 28 PID 1468 wrote to memory of 864 1468 nawe.exe 28 PID 864 wrote to memory of 1812 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 31 PID 864 wrote to memory of 1812 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 31 PID 864 wrote to memory of 1812 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 31 PID 864 wrote to memory of 1812 864 85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe 31 PID 1468 wrote to memory of 1812 1468 nawe.exe 31 PID 1468 wrote to memory of 1812 1468 nawe.exe 31 PID 1468 wrote to memory of 1688 1468 nawe.exe 33 PID 1468 wrote to memory of 1688 1468 nawe.exe 33 PID 1468 wrote to memory of 1688 1468 nawe.exe 33 PID 1468 wrote to memory of 1688 1468 nawe.exe 33 PID 1468 wrote to memory of 1688 1468 nawe.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe"C:\Users\Admin\AppData\Local\Temp\85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe"C:\Users\Admin\AppData\Local\Temp\85dcda24c38b94b1c7fecaa00d8ba604b50edce41d9a6b68e1584dc0fc4a4a1a.exe"3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Roaming\Icduer\nawe.exe"C:\Users\Admin\AppData\Roaming\Icduer\nawe.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Roaming\Icduer\nawe.exe"C:\Users\Admin\AppData\Roaming\Icduer\nawe.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1468
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe70f5c4d.bat"4⤵
- Deletes itself
PID:1812
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1192
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1132
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1688
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD5fe8d61a67cb576d773d09772842c97b9
SHA1448203b99535a166d6440b739b994be12ae293d9
SHA2561ec1d1cf795bc61221850bd6dea3b6bf019c85c3cbedbf5c4a1b9835966291b1
SHA5123718d17b90bc1e7c355ce83afe03560e53416380c43ed63bec4ef55a73abc46decdb199c26aa1cba27d24b44f78e4f9041983afe4194373bb51b71494e59ba74
-
Filesize
253KB
MD5a96f97df679dc3f4c68ef686c005abb6
SHA1e082ff345a8660078d1978946f37c7e0363d104d
SHA2567ca37b0f4ec9709c52f7ecccc82c54114b44c8e33aa6033c2dd175d326452b03
SHA512d3d4ca9c89e545d481d6991f18a19a34dc32c6d638f34955e7c8a4ccf3a597c205d37f01df0feb0b37052a978f8d9674107a8960a414d3a834a303c461b34b2c
-
Filesize
253KB
MD5a96f97df679dc3f4c68ef686c005abb6
SHA1e082ff345a8660078d1978946f37c7e0363d104d
SHA2567ca37b0f4ec9709c52f7ecccc82c54114b44c8e33aa6033c2dd175d326452b03
SHA512d3d4ca9c89e545d481d6991f18a19a34dc32c6d638f34955e7c8a4ccf3a597c205d37f01df0feb0b37052a978f8d9674107a8960a414d3a834a303c461b34b2c
-
Filesize
253KB
MD5a96f97df679dc3f4c68ef686c005abb6
SHA1e082ff345a8660078d1978946f37c7e0363d104d
SHA2567ca37b0f4ec9709c52f7ecccc82c54114b44c8e33aa6033c2dd175d326452b03
SHA512d3d4ca9c89e545d481d6991f18a19a34dc32c6d638f34955e7c8a4ccf3a597c205d37f01df0feb0b37052a978f8d9674107a8960a414d3a834a303c461b34b2c
-
Filesize
253KB
MD5a96f97df679dc3f4c68ef686c005abb6
SHA1e082ff345a8660078d1978946f37c7e0363d104d
SHA2567ca37b0f4ec9709c52f7ecccc82c54114b44c8e33aa6033c2dd175d326452b03
SHA512d3d4ca9c89e545d481d6991f18a19a34dc32c6d638f34955e7c8a4ccf3a597c205d37f01df0feb0b37052a978f8d9674107a8960a414d3a834a303c461b34b2c
-
Filesize
253KB
MD5a96f97df679dc3f4c68ef686c005abb6
SHA1e082ff345a8660078d1978946f37c7e0363d104d
SHA2567ca37b0f4ec9709c52f7ecccc82c54114b44c8e33aa6033c2dd175d326452b03
SHA512d3d4ca9c89e545d481d6991f18a19a34dc32c6d638f34955e7c8a4ccf3a597c205d37f01df0feb0b37052a978f8d9674107a8960a414d3a834a303c461b34b2c