Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe
Resource
win10v2004-20220812-en
General
-
Target
908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe
-
Size
199KB
-
MD5
980dea89593af497668e7de2fbb48570
-
SHA1
0e85acf266fd586e30aa60a678b7b5a934c2c6e0
-
SHA256
908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78
-
SHA512
0f68186ee620f3046e4d9d792d6c1328d203a9641bcb87c08b46f1c3be479136c010a7941d558a25c0268680399ad82b12d0efede5218f53d3b7804d9a644341
-
SSDEEP
3072:ax/DtO11yxCnhYvh9Yn1WyGbaZqubLvKiYRisWZ6qjWpJKNADqUQO4wZgJZ76:iG1eQn11Gba5LGRNWZ6gx1UnLgr76
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3912-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3912-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3912-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3912-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/612-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/612-154-0x0000000040010000-0x000000004004B000-memory.dmp upx behavioral2/memory/612-157-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4324 set thread context of 3912 4324 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 81 PID 2592 set thread context of 612 2592 services.exe 83 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\services.exe services.exe -
Suspicious behavior: RenamesItself 2 IoCs
pid Process 3912 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 612 services.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3912 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4324 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 2592 services.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 3912 4324 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 81 PID 4324 wrote to memory of 3912 4324 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 81 PID 4324 wrote to memory of 3912 4324 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 81 PID 4324 wrote to memory of 3912 4324 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 81 PID 4324 wrote to memory of 3912 4324 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 81 PID 4324 wrote to memory of 3912 4324 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 81 PID 4324 wrote to memory of 3912 4324 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 81 PID 4324 wrote to memory of 3912 4324 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 81 PID 3912 wrote to memory of 1396 3912 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 26 PID 3912 wrote to memory of 1396 3912 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 26 PID 3912 wrote to memory of 1396 3912 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 26 PID 3912 wrote to memory of 2592 3912 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 82 PID 3912 wrote to memory of 2592 3912 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 82 PID 3912 wrote to memory of 2592 3912 908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe 82 PID 2592 wrote to memory of 612 2592 services.exe 83 PID 2592 wrote to memory of 612 2592 services.exe 83 PID 2592 wrote to memory of 612 2592 services.exe 83 PID 2592 wrote to memory of 612 2592 services.exe 83 PID 2592 wrote to memory of 612 2592 services.exe 83 PID 2592 wrote to memory of 612 2592 services.exe 83 PID 2592 wrote to memory of 612 2592 services.exe 83 PID 2592 wrote to memory of 612 2592 services.exe 83 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84 PID 612 wrote to memory of 1116 612 services.exe 84
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe"C:\Users\Admin\AppData\Local\Temp\908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe"C:\Users\Admin\AppData\Local\Temp\908deab8ecd4ff9b72c3722dec57281e6fe762c0dc30978cb9f93eddbf9bfd78.exe"3⤵
- Suspicious behavior: RenamesItself
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\services.exe-bs4⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\services.exe"C:\Windows\services.exe"5⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵PID:1116
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2629973501-4017243118-3254762364-1000\88603cb2913a7df3fbd16b5f958e6447_e32e1c79-b88e-4709-94fb-81034ca3398e
Filesize51B
MD55fc2ac2a310f49c14d195230b91a8885
SHA190855cc11136ba31758fe33b5cf9571f9a104879
SHA256374e0e2897a7a82e0e44794cad89df0f3cdd7703886239c1fe06d625efd48092
SHA512ab46554df9174b9fe9beba50a640f67534c3812f64d96a1fb8adfdc136dfe730ca2370825cd45b7f87a544d6a58dd868cb5a3a7f42e2789f6d679dbc0fdd52c3