Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 01:31
Static task
static1
Behavioral task
behavioral1
Sample
96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe
-
Size
497KB
-
MD5
b8cc28af488668c1937b3624ff63e3d5
-
SHA1
87bbe47cad21b48c8eebdac3d5f6ebfb295b6736
-
SHA256
96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc
-
SHA512
8d6f5a75f971fd1182d58f7c8c6cd7ccce2eec741af3f75b15d5eae2e51821d0a35b7c9a9e483d561919501f42fa48b388748e7ce81c7354a22db936768b2799
-
SSDEEP
12288:WEA5KSbBhHZ1mhX/piQR9QTuB33vVQEKoJvZWK:WEAXbBh5KYQQceZoJvl
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\turmoilscape.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\turmoilscape.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Executes dropped EXE 2 IoCs
pid Process 2424 webengine.exe 116 MSBuild.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation webengine.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\webengine.exe" webengine.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4996 set thread context of 640 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 82 PID 116 set thread context of 3748 116 MSBuild.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 4 IoCs
pid Process 3604 reg.exe 4820 reg.exe 2612 reg.exe 1992 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 2424 webengine.exe 116 MSBuild.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 116 MSBuild.exe 2424 webengine.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeDebugPrivilege 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe Token: 1 640 AppLaunch.exe Token: SeCreateTokenPrivilege 640 AppLaunch.exe Token: SeAssignPrimaryTokenPrivilege 640 AppLaunch.exe Token: SeLockMemoryPrivilege 640 AppLaunch.exe Token: SeIncreaseQuotaPrivilege 640 AppLaunch.exe Token: SeMachineAccountPrivilege 640 AppLaunch.exe Token: SeTcbPrivilege 640 AppLaunch.exe Token: SeSecurityPrivilege 640 AppLaunch.exe Token: SeTakeOwnershipPrivilege 640 AppLaunch.exe Token: SeLoadDriverPrivilege 640 AppLaunch.exe Token: SeSystemProfilePrivilege 640 AppLaunch.exe Token: SeSystemtimePrivilege 640 AppLaunch.exe Token: SeProfSingleProcessPrivilege 640 AppLaunch.exe Token: SeIncBasePriorityPrivilege 640 AppLaunch.exe Token: SeCreatePagefilePrivilege 640 AppLaunch.exe Token: SeCreatePermanentPrivilege 640 AppLaunch.exe Token: SeBackupPrivilege 640 AppLaunch.exe Token: SeRestorePrivilege 640 AppLaunch.exe Token: SeShutdownPrivilege 640 AppLaunch.exe Token: SeDebugPrivilege 640 AppLaunch.exe Token: SeAuditPrivilege 640 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 640 AppLaunch.exe Token: SeChangeNotifyPrivilege 640 AppLaunch.exe Token: SeRemoteShutdownPrivilege 640 AppLaunch.exe Token: SeUndockPrivilege 640 AppLaunch.exe Token: SeSyncAgentPrivilege 640 AppLaunch.exe Token: SeEnableDelegationPrivilege 640 AppLaunch.exe Token: SeManageVolumePrivilege 640 AppLaunch.exe Token: SeImpersonatePrivilege 640 AppLaunch.exe Token: SeCreateGlobalPrivilege 640 AppLaunch.exe Token: 31 640 AppLaunch.exe Token: 32 640 AppLaunch.exe Token: 33 640 AppLaunch.exe Token: 34 640 AppLaunch.exe Token: 35 640 AppLaunch.exe Token: SeDebugPrivilege 2424 webengine.exe Token: SeDebugPrivilege 116 MSBuild.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 640 AppLaunch.exe 640 AppLaunch.exe 640 AppLaunch.exe 640 AppLaunch.exe 3748 AppLaunch.exe 3748 AppLaunch.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 4996 wrote to memory of 640 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 82 PID 4996 wrote to memory of 640 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 82 PID 4996 wrote to memory of 640 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 82 PID 4996 wrote to memory of 640 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 82 PID 4996 wrote to memory of 640 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 82 PID 4996 wrote to memory of 640 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 82 PID 4996 wrote to memory of 640 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 82 PID 4996 wrote to memory of 640 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 82 PID 640 wrote to memory of 4204 640 AppLaunch.exe 83 PID 640 wrote to memory of 4204 640 AppLaunch.exe 83 PID 640 wrote to memory of 4204 640 AppLaunch.exe 83 PID 640 wrote to memory of 3360 640 AppLaunch.exe 88 PID 640 wrote to memory of 3360 640 AppLaunch.exe 88 PID 640 wrote to memory of 3360 640 AppLaunch.exe 88 PID 640 wrote to memory of 4556 640 AppLaunch.exe 84 PID 640 wrote to memory of 4556 640 AppLaunch.exe 84 PID 640 wrote to memory of 4556 640 AppLaunch.exe 84 PID 640 wrote to memory of 2720 640 AppLaunch.exe 86 PID 640 wrote to memory of 2720 640 AppLaunch.exe 86 PID 640 wrote to memory of 2720 640 AppLaunch.exe 86 PID 4204 wrote to memory of 1992 4204 cmd.exe 91 PID 4204 wrote to memory of 1992 4204 cmd.exe 91 PID 4204 wrote to memory of 1992 4204 cmd.exe 91 PID 4556 wrote to memory of 4820 4556 cmd.exe 93 PID 4556 wrote to memory of 4820 4556 cmd.exe 93 PID 4556 wrote to memory of 4820 4556 cmd.exe 93 PID 2720 wrote to memory of 3604 2720 cmd.exe 92 PID 2720 wrote to memory of 3604 2720 cmd.exe 92 PID 2720 wrote to memory of 3604 2720 cmd.exe 92 PID 3360 wrote to memory of 2612 3360 cmd.exe 94 PID 3360 wrote to memory of 2612 3360 cmd.exe 94 PID 3360 wrote to memory of 2612 3360 cmd.exe 94 PID 4996 wrote to memory of 2424 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 95 PID 4996 wrote to memory of 2424 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 95 PID 4996 wrote to memory of 2424 4996 96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe 95 PID 2424 wrote to memory of 116 2424 webengine.exe 96 PID 2424 wrote to memory of 116 2424 webengine.exe 96 PID 2424 wrote to memory of 116 2424 webengine.exe 96 PID 116 wrote to memory of 3748 116 MSBuild.exe 97 PID 116 wrote to memory of 3748 116 MSBuild.exe 97 PID 116 wrote to memory of 3748 116 MSBuild.exe 97 PID 116 wrote to memory of 3748 116 MSBuild.exe 97 PID 116 wrote to memory of 3748 116 MSBuild.exe 97 PID 116 wrote to memory of 3748 116 MSBuild.exe 97 PID 116 wrote to memory of 3748 116 MSBuild.exe 97 PID 116 wrote to memory of 3748 116 MSBuild.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe"C:\Users\Admin\AppData\Local\Temp\96f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1992
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4820
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\turmoilscape.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\turmoilscape.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\turmoilscape.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\turmoilscape.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:3604
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2612
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\webengine.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\webengine.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\MSBuild.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe4⤵
- Suspicious use of SetWindowsHookEx
PID:3748
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
497KB
MD5b8cc28af488668c1937b3624ff63e3d5
SHA187bbe47cad21b48c8eebdac3d5f6ebfb295b6736
SHA25696f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc
SHA5128d6f5a75f971fd1182d58f7c8c6cd7ccce2eec741af3f75b15d5eae2e51821d0a35b7c9a9e483d561919501f42fa48b388748e7ce81c7354a22db936768b2799
-
Filesize
497KB
MD5b8cc28af488668c1937b3624ff63e3d5
SHA187bbe47cad21b48c8eebdac3d5f6ebfb295b6736
SHA25696f711da81e3dfa05defcc7806849663907dc1fe978b5215af6fdd79d22512bc
SHA5128d6f5a75f971fd1182d58f7c8c6cd7ccce2eec741af3f75b15d5eae2e51821d0a35b7c9a9e483d561919501f42fa48b388748e7ce81c7354a22db936768b2799
-
Filesize
8KB
MD58117d80b0e093b8a22808439e98f8438
SHA195e85605a119569be1171e738ab1933d72b4d4ac
SHA256e1d07433984dc20260f212e464fcdd75e0cca098b4c40d9d940ad71995e74699
SHA512bef89879f3b5e3b9a3cad130ef33ca6d9a6b55e0b47dd6c47fd94efb343bf9b5d904bdccc52e2416ac68d12a1077102a2015fd8c9f92defcb83514f0d10e06a3
-
Filesize
8KB
MD58117d80b0e093b8a22808439e98f8438
SHA195e85605a119569be1171e738ab1933d72b4d4ac
SHA256e1d07433984dc20260f212e464fcdd75e0cca098b4c40d9d940ad71995e74699
SHA512bef89879f3b5e3b9a3cad130ef33ca6d9a6b55e0b47dd6c47fd94efb343bf9b5d904bdccc52e2416ac68d12a1077102a2015fd8c9f92defcb83514f0d10e06a3