Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
48s -
max time network
88s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 05:23
Static task
static1
Behavioral task
behavioral1
Sample
2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe
Resource
win10v2004-20221111-en
General
-
Target
2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe
-
Size
267KB
-
MD5
1e7f33ab7b2afd6ad43db35218c2a920
-
SHA1
5c86f0e35cb0c828fec223ae975275980c03b21b
-
SHA256
2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236
-
SHA512
e723fadfa182eff0c5d36a3169393a8bfea84dcf595a4a425d9937f920a4aba9847f3a43b83ca52a60e1a235aff7d51aa97d6c309ffcf410aa0234999d084549
-
SSDEEP
6144:KxZacIb6dRk68ciOXPSLy4IOcDYCNMiZICI5:KpRk6tiOXR4Jc8RiI
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 676 spoaintxiPS4mg.exe 1920 spoaintxiPS4mg.exe -
Deletes itself 1 IoCs
pid Process 1920 spoaintxiPS4mg.exe -
Loads dropped DLL 4 IoCs
pid Process 2040 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 2040 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 2040 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 1920 spoaintxiPS4mg.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\8GNz1h2BBU3Buf = "C:\\ProgramData\\5BZozm3fw0\\spoaintxiPS4mg.exe" 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1252 set thread context of 2040 1252 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 28 PID 676 set thread context of 1920 676 spoaintxiPS4mg.exe 30 PID 1920 set thread context of 1348 1920 spoaintxiPS4mg.exe 31 -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1252 wrote to memory of 2040 1252 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 28 PID 1252 wrote to memory of 2040 1252 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 28 PID 1252 wrote to memory of 2040 1252 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 28 PID 1252 wrote to memory of 2040 1252 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 28 PID 1252 wrote to memory of 2040 1252 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 28 PID 1252 wrote to memory of 2040 1252 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 28 PID 2040 wrote to memory of 676 2040 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 29 PID 2040 wrote to memory of 676 2040 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 29 PID 2040 wrote to memory of 676 2040 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 29 PID 2040 wrote to memory of 676 2040 2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe 29 PID 676 wrote to memory of 1920 676 spoaintxiPS4mg.exe 30 PID 676 wrote to memory of 1920 676 spoaintxiPS4mg.exe 30 PID 676 wrote to memory of 1920 676 spoaintxiPS4mg.exe 30 PID 676 wrote to memory of 1920 676 spoaintxiPS4mg.exe 30 PID 676 wrote to memory of 1920 676 spoaintxiPS4mg.exe 30 PID 676 wrote to memory of 1920 676 spoaintxiPS4mg.exe 30 PID 1920 wrote to memory of 1348 1920 spoaintxiPS4mg.exe 31 PID 1920 wrote to memory of 1348 1920 spoaintxiPS4mg.exe 31 PID 1920 wrote to memory of 1348 1920 spoaintxiPS4mg.exe 31 PID 1920 wrote to memory of 1348 1920 spoaintxiPS4mg.exe 31 PID 1920 wrote to memory of 1348 1920 spoaintxiPS4mg.exe 31 PID 1920 wrote to memory of 1348 1920 spoaintxiPS4mg.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe"C:\Users\Admin\AppData\Local\Temp\2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe"C:\Users\Admin\AppData\Local\Temp\2d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\ProgramData\5BZozm3fw0\spoaintxiPS4mg.exe"C:\ProgramData\5BZozm3fw0\spoaintxiPS4mg.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:676 -
C:\ProgramData\5BZozm3fw0\spoaintxiPS4mg.exe"C:\ProgramData\5BZozm3fw0\spoaintxiPS4mg.exe"4⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files (x86)\Windows Media Player\wmpenc.exe"C:\Program Files (x86)\Windows Media Player\wmpenc.exe" /i:19205⤵PID:1348
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD58fab373e9fed319becc539cb252dae56
SHA19697b22f59122f20a784913c4604b54812ed3d04
SHA256333d9c01257f2eaaa27598ca112f78cf1c409d9f2734d405aa24ebc5af2573b7
SHA512decf01b2f7396e02c3c0b50b3196e9dfb72701574929de604e4696353e686f7a5308855d87651e09944b2380486202335640d41536b44460e034698e944c7514
-
Filesize
267KB
MD58fab373e9fed319becc539cb252dae56
SHA19697b22f59122f20a784913c4604b54812ed3d04
SHA256333d9c01257f2eaaa27598ca112f78cf1c409d9f2734d405aa24ebc5af2573b7
SHA512decf01b2f7396e02c3c0b50b3196e9dfb72701574929de604e4696353e686f7a5308855d87651e09944b2380486202335640d41536b44460e034698e944c7514
-
Filesize
267KB
MD58fab373e9fed319becc539cb252dae56
SHA19697b22f59122f20a784913c4604b54812ed3d04
SHA256333d9c01257f2eaaa27598ca112f78cf1c409d9f2734d405aa24ebc5af2573b7
SHA512decf01b2f7396e02c3c0b50b3196e9dfb72701574929de604e4696353e686f7a5308855d87651e09944b2380486202335640d41536b44460e034698e944c7514
-
Filesize
267KB
MD58fab373e9fed319becc539cb252dae56
SHA19697b22f59122f20a784913c4604b54812ed3d04
SHA256333d9c01257f2eaaa27598ca112f78cf1c409d9f2734d405aa24ebc5af2573b7
SHA512decf01b2f7396e02c3c0b50b3196e9dfb72701574929de604e4696353e686f7a5308855d87651e09944b2380486202335640d41536b44460e034698e944c7514
-
Filesize
267KB
MD58fab373e9fed319becc539cb252dae56
SHA19697b22f59122f20a784913c4604b54812ed3d04
SHA256333d9c01257f2eaaa27598ca112f78cf1c409d9f2734d405aa24ebc5af2573b7
SHA512decf01b2f7396e02c3c0b50b3196e9dfb72701574929de604e4696353e686f7a5308855d87651e09944b2380486202335640d41536b44460e034698e944c7514
-
Filesize
267KB
MD51e7f33ab7b2afd6ad43db35218c2a920
SHA15c86f0e35cb0c828fec223ae975275980c03b21b
SHA2562d6fc2a4cab93c3d4566a5acfa8311c9ab0b9915cd19e66fa7b8f2140a214236
SHA512e723fadfa182eff0c5d36a3169393a8bfea84dcf595a4a425d9937f920a4aba9847f3a43b83ca52a60e1a235aff7d51aa97d6c309ffcf410aa0234999d084549
-
Filesize
267KB
MD58fab373e9fed319becc539cb252dae56
SHA19697b22f59122f20a784913c4604b54812ed3d04
SHA256333d9c01257f2eaaa27598ca112f78cf1c409d9f2734d405aa24ebc5af2573b7
SHA512decf01b2f7396e02c3c0b50b3196e9dfb72701574929de604e4696353e686f7a5308855d87651e09944b2380486202335640d41536b44460e034698e944c7514