Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 01:21
Static task
static1
Behavioral task
behavioral1
Sample
90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe
-
Size
287KB
-
MD5
7099ebe12d1229a6700e41a1e8fb2306
-
SHA1
c6646fd6c3295cf4507604d5a6e13bd3ce9d4424
-
SHA256
90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d
-
SHA512
00457e024c372f8023aeb0ba324d351d259b17f047d80ed6b9054fcd7159274210378f17a5aef33b11a3c28946bc4388c5cfbf82c2a9345479782ac9c34c748f
-
SSDEEP
6144:atwxm2tOHRMdTBUnUBK2MflHHiezy85dEJkMsOD:vAHRBU6HHiemwEJb
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\90B4D4~1.EXE," 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\90B4D4~1.EXE" 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\90B4D4~1.EXE" 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\60928fbc = "HÖH\x16w¦YúçÝ¿VE:š¬³Ÿ¥]\u008f§ Ü\u008f\x15˜*¨Û\x0e\x04Ím„;P\x18H\x06í&P\x03%ÇŠ{/\a‡(g\x02©:ª9Q\x1e›\x7fñ¾8e=\u008d\x01…˜¸\u008fÞ-Zy2j?j\x062\x0eÃ*HBlõ)ßknA`x¢\x03¬q\x1b“9ÜÛnD\x06´Žë´Ûã{;+³Ì{Ûžœ+4T{\x16›+\fÌyaÛ\tÔ”ìtéÖsA~l„Ó3»ûËvŒt|\x044ä\x13c4qÆ{,Œ$´Qœ$4¾lÜ<‹‹K›™îÓK¼f»SÄ¡t<Ä\x1c\x06C»yÌ©ûlD\x14Ù³dqÛù\x1b\x14ÓƹÌÖ\x04»^)©ìäÓAùl;áYÁî|\x11^Ž¤£ëü‹I!ù\\¼l£#”ó¼›´" 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe Token: SeSecurityPrivilege 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe Token: SeSecurityPrivilege 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe Token: SeSecurityPrivilege 208 90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe"C:\Users\Admin\AppData\Local\Temp\90b4d48a560f9f0a36cda2f6522e1e5499db94c376fe4c4f5f0ef6d09bd5be4d.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208