Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 21:15
Static task
static1
Behavioral task
behavioral1
Sample
d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe
Resource
win10v2004-20220812-en
General
-
Target
d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe
-
Size
384KB
-
MD5
961ed7877734896802618112caa231b7
-
SHA1
2af29cbc48dfcc433a43ecd1e864c0e8b0b88928
-
SHA256
d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14
-
SHA512
d494e9be3afc75b3b3672feeb593e4fe59c2e3c72621ce4b8a2990e2ee8854276e3cdfc0749174af237a60c3b5007b4096c83f68c2132fe90b2fc0e78ca7a6d3
-
SSDEEP
6144:lmAN2VXVN29dppKp91YbR6IydCrBbif/62N0TXRALU:lmBVXVMnop91Y90cif5NQRALU
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1644 fF21703HpOeM21703.exe -
resource yara_rule behavioral1/memory/676-56-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral1/memory/676-57-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral1/memory/1644-63-0x0000000000400000-0x00000000004C3000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\fF21703HpOeM21703 = "C:\\ProgramData\\fF21703HpOeM21703\\fF21703HpOeM21703.exe" fF21703HpOeM21703.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 1644 fF21703HpOeM21703.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 1644 fF21703HpOeM21703.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 1644 fF21703HpOeM21703.exe 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 1644 fF21703HpOeM21703.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe Token: SeDebugPrivilege 1644 fF21703HpOeM21703.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 676 wrote to memory of 1644 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 28 PID 676 wrote to memory of 1644 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 28 PID 676 wrote to memory of 1644 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 28 PID 676 wrote to memory of 1644 676 d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe"C:\Users\Admin\AppData\Local\Temp\d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:676 -
C:\ProgramData\fF21703HpOeM21703\fF21703HpOeM21703.exe"C:\ProgramData\fF21703HpOeM21703\fF21703HpOeM21703.exe" "C:\Users\Admin\AppData\Local\Temp\d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD51f9d8d7001bc203b07c41b18c05f3329
SHA1f5c3cf4c8a1aa40c987af8bcef2a9f06a0f4e83c
SHA2567d88ab8ae29d8f32a7cf1e49558943bcf1f347139c2903cda9272e835cae0dc9
SHA5124d3cf511f6da5016d0f63ceb91a3cc3ad5f80b78c16b00471e34a5145b933c54923b358940163705df49e828fd65db03270ef226a71e0dab5df277eb8eb33683
-
Filesize
384KB
MD51f9d8d7001bc203b07c41b18c05f3329
SHA1f5c3cf4c8a1aa40c987af8bcef2a9f06a0f4e83c
SHA2567d88ab8ae29d8f32a7cf1e49558943bcf1f347139c2903cda9272e835cae0dc9
SHA5124d3cf511f6da5016d0f63ceb91a3cc3ad5f80b78c16b00471e34a5145b933c54923b358940163705df49e828fd65db03270ef226a71e0dab5df277eb8eb33683
-
Filesize
384KB
MD51f9d8d7001bc203b07c41b18c05f3329
SHA1f5c3cf4c8a1aa40c987af8bcef2a9f06a0f4e83c
SHA2567d88ab8ae29d8f32a7cf1e49558943bcf1f347139c2903cda9272e835cae0dc9
SHA5124d3cf511f6da5016d0f63ceb91a3cc3ad5f80b78c16b00471e34a5145b933c54923b358940163705df49e828fd65db03270ef226a71e0dab5df277eb8eb33683
-
Filesize
384KB
MD51f9d8d7001bc203b07c41b18c05f3329
SHA1f5c3cf4c8a1aa40c987af8bcef2a9f06a0f4e83c
SHA2567d88ab8ae29d8f32a7cf1e49558943bcf1f347139c2903cda9272e835cae0dc9
SHA5124d3cf511f6da5016d0f63ceb91a3cc3ad5f80b78c16b00471e34a5145b933c54923b358940163705df49e828fd65db03270ef226a71e0dab5df277eb8eb33683