Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 22:10
Static task
static1
Behavioral task
behavioral1
Sample
892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe
-
Size
150KB
-
MD5
dd60171a9b6dc182bded63a64e3e3f29
-
SHA1
a6f5a7f1c925f5b29b0eaaba479292ba3d3f7d6d
-
SHA256
892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b
-
SHA512
d4a78a26721a5077409518650baf1841ab8f9459ef11d16b68ba342c08235eb516fff8f7fde8f28376ab37055add68a39b86b2fb5b72f5ae354e425a745bc40e
-
SSDEEP
3072:0lctl8STlrLKnRVWh0q8ntMviU9tv+SRtcFcoeYkmkC1:0UlJTJLKXq8ntMviU9tmSRqiAkmJ
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/992-64-0x0000000000400000-0x0000000000430000-memory.dmp family_gh0strat -
Executes dropped EXE 2 IoCs
pid Process 992 520.tmp 1988 inlEA33.tmp -
Deletes itself 1 IoCs
pid Process 856 cmd.exe -
Loads dropped DLL 3 IoCs
pid Process 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 1456 cmd.exe 1456 cmd.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\loader.dll 520.tmp File created C:\Program Files\Common Files\lanmao.dll 520.tmp -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\6ceba7.msi msiexec.exe File opened for modification C:\Windows\Installer\6ceba7.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\6cebab.msi msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log expand.exe File created C:\WINDOWS\vbcfg.ini 520.tmp File opened for modification C:\Windows\Installer\MSIEF20.tmp msiexec.exe File opened for modification C:\Windows\Installer\6ceba9.ipi msiexec.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log expand.exe File created C:\Windows\Installer\6ceba9.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 1696 msiexec.exe 1696 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 980 msiexec.exe Token: SeIncreaseQuotaPrivilege 980 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeSecurityPrivilege 1696 msiexec.exe Token: SeCreateTokenPrivilege 980 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 980 msiexec.exe Token: SeLockMemoryPrivilege 980 msiexec.exe Token: SeIncreaseQuotaPrivilege 980 msiexec.exe Token: SeMachineAccountPrivilege 980 msiexec.exe Token: SeTcbPrivilege 980 msiexec.exe Token: SeSecurityPrivilege 980 msiexec.exe Token: SeTakeOwnershipPrivilege 980 msiexec.exe Token: SeLoadDriverPrivilege 980 msiexec.exe Token: SeSystemProfilePrivilege 980 msiexec.exe Token: SeSystemtimePrivilege 980 msiexec.exe Token: SeProfSingleProcessPrivilege 980 msiexec.exe Token: SeIncBasePriorityPrivilege 980 msiexec.exe Token: SeCreatePagefilePrivilege 980 msiexec.exe Token: SeCreatePermanentPrivilege 980 msiexec.exe Token: SeBackupPrivilege 980 msiexec.exe Token: SeRestorePrivilege 980 msiexec.exe Token: SeShutdownPrivilege 980 msiexec.exe Token: SeDebugPrivilege 980 msiexec.exe Token: SeAuditPrivilege 980 msiexec.exe Token: SeSystemEnvironmentPrivilege 980 msiexec.exe Token: SeChangeNotifyPrivilege 980 msiexec.exe Token: SeRemoteShutdownPrivilege 980 msiexec.exe Token: SeUndockPrivilege 980 msiexec.exe Token: SeSyncAgentPrivilege 980 msiexec.exe Token: SeEnableDelegationPrivilege 980 msiexec.exe Token: SeManageVolumePrivilege 980 msiexec.exe Token: SeImpersonatePrivilege 980 msiexec.exe Token: SeCreateGlobalPrivilege 980 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe Token: SeRestorePrivilege 1696 msiexec.exe Token: SeTakeOwnershipPrivilege 1696 msiexec.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1048 wrote to memory of 992 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 27 PID 1048 wrote to memory of 992 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 27 PID 1048 wrote to memory of 992 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 27 PID 1048 wrote to memory of 992 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 27 PID 1048 wrote to memory of 992 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 27 PID 1048 wrote to memory of 992 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 27 PID 1048 wrote to memory of 992 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 27 PID 1048 wrote to memory of 980 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 28 PID 1048 wrote to memory of 980 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 28 PID 1048 wrote to memory of 980 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 28 PID 1048 wrote to memory of 980 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 28 PID 1048 wrote to memory of 980 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 28 PID 1048 wrote to memory of 980 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 28 PID 1048 wrote to memory of 980 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 28 PID 1696 wrote to memory of 884 1696 msiexec.exe 30 PID 1696 wrote to memory of 884 1696 msiexec.exe 30 PID 1696 wrote to memory of 884 1696 msiexec.exe 30 PID 1696 wrote to memory of 884 1696 msiexec.exe 30 PID 1696 wrote to memory of 884 1696 msiexec.exe 30 PID 1696 wrote to memory of 884 1696 msiexec.exe 30 PID 1696 wrote to memory of 884 1696 msiexec.exe 30 PID 1048 wrote to memory of 1456 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 32 PID 1048 wrote to memory of 1456 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 32 PID 1048 wrote to memory of 1456 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 32 PID 1048 wrote to memory of 1456 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 32 PID 1048 wrote to memory of 1444 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 33 PID 1048 wrote to memory of 1444 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 33 PID 1048 wrote to memory of 1444 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 33 PID 1048 wrote to memory of 1444 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 33 PID 1048 wrote to memory of 856 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 37 PID 1048 wrote to memory of 856 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 37 PID 1048 wrote to memory of 856 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 37 PID 1048 wrote to memory of 856 1048 892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe 37 PID 1444 wrote to memory of 1968 1444 cmd.exe 35 PID 1444 wrote to memory of 1968 1444 cmd.exe 35 PID 1444 wrote to memory of 1968 1444 cmd.exe 35 PID 1444 wrote to memory of 1968 1444 cmd.exe 35 PID 1456 wrote to memory of 1988 1456 cmd.exe 38 PID 1456 wrote to memory of 1988 1456 cmd.exe 38 PID 1456 wrote to memory of 1988 1456 cmd.exe 38 PID 1456 wrote to memory of 1988 1456 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe"C:\Users\Admin\AppData\Local\Temp\892d35e25ed0fbead120f64117cbcf520f41a668fb928e80e0cc2ad242e6ed7b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Roaming\520.tmpC:\Users\Admin\AppData\Roaming\520.tmp2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:992
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\INSAB7~1.INI /quiet2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:980
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\inlEA33.tmpC:\Users\Admin\AppData\Local\Temp\inlEA33.tmp cdf1912.tmp3⤵
- Executes dropped EXE
PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\expand.exeexpand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"3⤵
- Drops file in Windows directory
PID:1968
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\892D35~1.EXE > nul2⤵
- Deletes itself
PID:856
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DCA43253763829B624310E7D466C56C42⤵PID:884
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5756f0c23e876d0fdf1186cd248dbda7f
SHA19eed50e38f5c633a447028a035ef794c7d49a292
SHA256b03d856567ce7d9cf87f68861f8123ce4d763d6c1ac713a65e76df2b643dcb33
SHA51270d40853023e7a8f29bf54415d94a152757ff93d966ff4a3daaa755d29d0711bfb2037160435ac1aa6f93d875fb6232143bbc6272d369dbe21eb978e1130a2f1
-
Filesize
768B
MD5d20d9eda31a2d0300e4589df7f352370
SHA179b46d2dbb489914cfedafdbc90e62951471b48e
SHA256d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8
SHA512d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e
-
Filesize
84.8MB
MD56c2f81b60559f7ec1f17e2debb24044a
SHA13a1883f3e18eec303b40256a922988531b4a489a
SHA256306020a6e048b71d8c1d7f499cc8fa06585d925b2a8d5d8b59534043d48c2ee9
SHA512b7a163df98d376808fd715137b316d85b0176b57c3bbb651fdbbcdb84db29d2e9e445bffe0356f424ba30aa0f70c0e6c827ab56fcea13e0d74a08226d4ed7dd0
-
Filesize
81.7MB
MD5a42f574474fbd83d2b74b9b279d37403
SHA1d8c6afdb8c15c9ceb4aa905b23cb00f2da3a4e83
SHA2566dab3b135bcbd205b04b05ff62c4d0fa91c3126b04ef3b34d7f9df48c1eeae54
SHA51250ee752e8e43e5a835d0cb1a533c89a25819661f633716663bd46e22c12230e72988cacc11b256b15784b6f5ea5075f75ab1f9a28039fe28284654d665f1efec
-
Filesize
57B
MD5bd9b1c76eb71cc2fc5deebff03b3a974
SHA1ce55e59dd4236ce7ebcb05e953bb12631e1bd552
SHA256b5a7974eb57f7598cdf0df5938456ffec600bebca38d0308c52d86e6c8680914
SHA512a0a08617749b1689e0abdef3a18ce2de74c2ae88b717fcec5f53f32ae9fc4f30e81602bb9ff2f4989ebb2dfaa9cf2e5157c6261d648af976f460dc270f534005
-
Filesize
98B
MD58663de6fce9208b795dc913d1a6a3f5b
SHA1882193f208cf012eaf22eeaa4fef3b67e7c67c15
SHA2562909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61
SHA5129381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688
-
Filesize
177.4MB
MD52f3ff5f00924353de5374bdb1cdc0f91
SHA1d3a30c75ddb26c6b0c073c327d44cb1bead03d26
SHA25672d5a611160119fabe828952f45aba65501b6e8a08b014819b261f539868cf8b
SHA512d698c368daa0ca83726b50f27356699e52222c40bfd426964759f077035a4ed9b3371be665bde87278490037829a42b63addfa985618d13583536305ef7a552c
-
Filesize
173.4MB
MD57d85caa9bb5e267e930dab75200f2656
SHA13280406b198422aa358713ed7c5cfd4bec5727f2
SHA256fdb074b54aa58cf668265a28e67e196b772d82f8aba8f829b79d972608854356
SHA512bfc3c8b777abdc665faa898d73a9d71c727d1c9ca8d4f186cfe49eab338e622b39dce68db0ca129e220f3966ff16940748becec263d4571993fc4719d167df0e
-
Filesize
425B
MD5da68bc3b7c3525670a04366bc55629f5
SHA115fda47ecfead7db8f7aee6ca7570138ba7f1b71
SHA25673f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5
SHA5126fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0
-
Filesize
82.9MB
MD5645ebdcb02f39eb4bc8ce4f118375395
SHA119b1cea3f5f657a663829a0b71a29e1df3f30c25
SHA25649d31b90bdd87bea16663ecfeb60937edd9df03ee7167dff2c0ae5bba95129f0
SHA512f74cf71a81cfa9b2b1e74ca93f286a76d361681ae22eb94f3a416801de3f50d7b86e1b0fa4f2b6f1bdad45faa712e52f39098da32aee16ff6954ebcecc9711d2
-
Filesize
83.3MB
MD51231564fe72dd5ce18d03b169ee6d25c
SHA19e3de393ca03e12d5958d8724baba027db5a6a4d
SHA256b83fdf4be35c13c78be5e8b2da8d6baf2391bef6089fea0041430eca0ef09e19
SHA512fdc12ad0ee4c86436f060a353444a264312be105b078c5b19122cf15056f6a25aa9c99a8e2cfa20eacc86a6bfb8e6facd73fb28502cee84a1c6e168b1bdbe455
-
Filesize
179.1MB
MD54fdd51bf68595b86b50b2fad8fc278cc
SHA1c97d4c760ddef6c9bdb9c59dca645c38f027d5cf
SHA25602fa899559a7c8a1e67f80638ebce472cc12c3c000fd2cb03b147300cbb48457
SHA5126c7802449a72f1b81ff4632b0b7e2a92cc17d7462f475d2c8cebb39705945cddfa5f15a3baa6ed01000d9f1df6c8266d4c23d4196373c920593350b4bd8daebb