Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
203s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 02:01
Static task
static1
Behavioral task
behavioral1
Sample
434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe
-
Size
376KB
-
MD5
cdf297231e23d96a030d0f9e0e2af590
-
SHA1
083b9a924b714324c443230d124609cfa812bfc8
-
SHA256
434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5
-
SHA512
7d40adfd1d677baf5180cd08ee350df1ca623043f65ee85cbfaa15ee0166013a97336c9779b3c4ac42159a536172d2821ec22a0f044b1ac534d120240db1c2b7
-
SSDEEP
6144:i1toUIGHWDGjv6wllU8jHIYNq+MFTW2k1Q0Era4on8DsUL9HcK:6oUpW65lU8jztMFTW2+6+58DTz
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe," 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntos.exe 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe File created C:\Windows\SysWOW64\ntos.exe 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3 PID 476 wrote to memory of 620 476 434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe 3
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe"C:\Users\Admin\AppData\Local\Temp\434d8d54d039e42c4f16ea47a8735a3c0b922d970d7d2a402ffc28329a07daa5.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:476