Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 06:16
Static task
static1
Behavioral task
behavioral1
Sample
07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe
Resource
win10v2004-20221111-en
General
-
Target
07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe
-
Size
655KB
-
MD5
50bce9ba70d6529eb7a26ede8d584950
-
SHA1
3929bc52d33e6182b6f6e99e83949ea84987d1c0
-
SHA256
07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd
-
SHA512
ab25cc25fdb4ae227b16278138842b8616cf61e7fe4c72614afcb48f77bfe61ea547b564e25987d8a7896a9968b14909f60d46095d5446594a21504a862db858
-
SSDEEP
1536:1BQZjlDtdDkM0ncL79l1wUEkWLj3uWHmdmLoys5IJ+I7KyALeoIk0lYUTPj68:eJtdYEf9REkwjjSQs5IUI7GCoI/lLn
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Sookmasmyt = "C:\\Windows\\SysWOW64\\auditpolj.exe" 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe -
Executes dropped EXE 1 IoCs
pid Process 1664 auditpolj.exe -
resource yara_rule behavioral1/memory/1280-55-0x0000000000520000-0x00000000005C9000-memory.dmp upx behavioral1/memory/1280-59-0x0000000000520000-0x00000000005C9000-memory.dmp upx behavioral1/memory/1280-58-0x0000000000520000-0x00000000005C9000-memory.dmp upx behavioral1/memory/1280-73-0x00000000003B0000-0x00000000003F7000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe -
Deletes itself 1 IoCs
pid Process 584 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\auditpolj.exe 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe File created C:\Windows\SysWOW64\auditpolj.exe 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe 1664 auditpolj.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe Token: SeDebugPrivilege 1664 auditpolj.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1280 wrote to memory of 1664 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe 27 PID 1280 wrote to memory of 1664 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe 27 PID 1280 wrote to memory of 1664 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe 27 PID 1280 wrote to memory of 1664 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe 27 PID 1280 wrote to memory of 584 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe 29 PID 1280 wrote to memory of 584 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe 29 PID 1280 wrote to memory of 584 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe 29 PID 1280 wrote to memory of 584 1280 07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe"C:\Users\Admin\AppData\Local\Temp\07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe"1⤵
- Adds policy Run key to start application
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\auditpolj.exeC:\Windows\SysWOW64\auditpolj.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
C:\Windows\SysWOW64\cmd.exe/c C:\Users\Admin\AppData\Local\Temp\~unins9613.bat "C:\Users\Admin\AppData\Local\Temp\07adf47c0c7a35ecfd5e51555f6b66ae7a4d794f88548c43e09a81cae961a8bd.exe"2⤵
- Deletes itself
PID:584
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49B
MD59e0a2f5ab30517809b95a1ff1dd98c53
SHA15c1eefdf10e67d1e9216e2e3f5e92352d583c9ce
SHA25697ac9fee75a1f7b63b3115e9c4fb9dda80b1caba26d2fb51325670dee261fe32
SHA512e959cc1fd48fb1cccf135a697924c775a3812bab211fc7f9b00c5a9d617261d84c5d6f7cb548774c1e8f46811b06ca39c5603d0e10cbcb7b805f9abbe49b9b42
-
Filesize
173KB
MD5578d5d9c5be72e21fdef508657b4ee32
SHA1334b3f84777cdebd5fca0c120fab31c71dcce965
SHA2565bea26318dc02804ded7215423b23208ee89156150539d46cf1ac17174737d4e
SHA5128ae1cc717f65bd640aa15104abd728ca7f909349cee445f42b8b46c238f609cba72691ce9f444ddbb5fabdb9807da9e064e43322f3d3240b3ad23161f7ef02fa
-
Filesize
173KB
MD5578d5d9c5be72e21fdef508657b4ee32
SHA1334b3f84777cdebd5fca0c120fab31c71dcce965
SHA2565bea26318dc02804ded7215423b23208ee89156150539d46cf1ac17174737d4e
SHA5128ae1cc717f65bd640aa15104abd728ca7f909349cee445f42b8b46c238f609cba72691ce9f444ddbb5fabdb9807da9e064e43322f3d3240b3ad23161f7ef02fa
-
Filesize
173KB
MD5578d5d9c5be72e21fdef508657b4ee32
SHA1334b3f84777cdebd5fca0c120fab31c71dcce965
SHA2565bea26318dc02804ded7215423b23208ee89156150539d46cf1ac17174737d4e
SHA5128ae1cc717f65bd640aa15104abd728ca7f909349cee445f42b8b46c238f609cba72691ce9f444ddbb5fabdb9807da9e064e43322f3d3240b3ad23161f7ef02fa