Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
175s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe
-
Size
325KB
-
MD5
4154cb1420649fbb8d236a998e6381b6
-
SHA1
80b08511710e757a073a5879f33d7c1748c2afbd
-
SHA256
b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f
-
SHA512
a9f9e31f79eae5215ccdb81103a3e60c1ad5643a5637259423270f8432903f7e8ad8b2982616886d9a798e6b58e2a4550c3173f3337df0a4df0ce745af3caf25
-
SSDEEP
6144:YRjDlYcQunzWY/bnpof88WHt55i+Y539Cnu/bzFp5:Y07ubnGYHt553Y5Yu/b5/
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe -
Modifies security service 2 TTPs 12 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe -
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
pid Process 1772 cmd.exe -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini services.exe File created \systemroot\assembly\GAC_32\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1296 set thread context of 1772 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 27 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Installer\{bb8ab67a-d838-2496-fd4e-ead6952e3208}\@ b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 460 services.exe 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe Token: SeDebugPrivilege 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe Token: SeDebugPrivilege 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe Token: SeDebugPrivilege 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe Token: SeDebugPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeShutdownPrivilege 1380 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1296 wrote to memory of 1380 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 14 PID 1296 wrote to memory of 460 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 3 PID 1296 wrote to memory of 1772 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 27 PID 1296 wrote to memory of 1772 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 27 PID 1296 wrote to memory of 1772 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 27 PID 1296 wrote to memory of 1772 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 27 PID 1296 wrote to memory of 1772 1296 b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe 27
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460
-
C:\Users\Admin\AppData\Local\Temp\b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe"C:\Users\Admin\AppData\Local\Temp\b5ff177f3a727f52634595d6cbe71ef21da068386eeaf2d9971f4bfb4c78e80f.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1380
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
PID:1772
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD573ee48b9909dbf314551fab55c081092
SHA17f4f36e167713f95d4e12de6cd3fe5c2d96b5216
SHA2566b090e21f26e840a286b364c1f20e866c5ef15d9aa7bc8acac8c87a93ec9619e
SHA512e19c05a1350cb98e5090682c3a8e8db4460e4f409791f25c6c3927458e779607679702efd2e90ce7c26c5a69c941c1aec337b453c97ab4ad50f4f85c5c1cf4e5