Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
200s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe
Resource
win10v2004-20220812-en
General
-
Target
91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe
-
Size
214KB
-
MD5
b9127a2bf6596a1be7c9820af4641ad9
-
SHA1
a3e39863616b50bc08aaae63f39774de0e9eb271
-
SHA256
91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac
-
SHA512
c52c658a2c5e7be8ab88ec18735381f6666a3e3ddeaa8f1ea3096c2b8975eed7dcd533afd3541a9d38afacf619a24d14f01f32d3a88c232ec8e8fa94e64006c9
-
SSDEEP
3072:s1IrCGCyzfGfHYYmvfB3tlLZkc+ORFRin/wYJT4hkONiVWVPk7eMgzSH+HqwN:s1WCGCyyOh9d2KRu/bJTNzYVPkMmHYp
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 332 csrss.exe -
Deletes itself 1 IoCs
pid Process 892 cmd.exe -
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 94.242.250.64 Destination IP 94.242.250.64 Destination IP 94.242.250.64 Destination IP 94.242.250.64 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1788 set thread context of 892 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 28 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 332 csrss.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1208 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe Token: SeDebugPrivilege 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe Token: SeShutdownPrivilege 1208 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 332 csrss.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1788 wrote to memory of 1208 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 13 PID 1788 wrote to memory of 332 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 26 PID 1788 wrote to memory of 892 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 28 PID 1788 wrote to memory of 892 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 28 PID 1788 wrote to memory of 892 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 28 PID 1788 wrote to memory of 892 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 28 PID 1788 wrote to memory of 892 1788 91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe 28 PID 332 wrote to memory of 864 332 csrss.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe"C:\Users\Admin\AppData\Local\Temp\91a631c9bf276531c70c03ba8f34feb48f6976e9a1eac12cacf838389a2e9aac.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:892
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵PID:864
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD56bf2039986af96d98e08824ac6c383fd
SHA10bb6384656a96943cb427baa92446f987219a02e
SHA256a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f
SHA512fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e
-
Filesize
2KB
MD5033ff7fd0dd1b0d651e59067e8cf6d0b
SHA1333477caf56e26c2200a677f785eebc625c58572
SHA256580cc839f33b94814d757d0e6a164460e479e74800ef697ef626c7d649984b4c
SHA512b769bb42019ce4dcbee6f12ac29948f266affe66cc2798a62285dadbe27b3af8cd0c32f25c638647df6814a7b16806d2b264e2c3f666a82cba3cace2a8dfcb5e
-
Filesize
52KB
MD56bf2039986af96d98e08824ac6c383fd
SHA10bb6384656a96943cb427baa92446f987219a02e
SHA256a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f
SHA512fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e