Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    194s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 05:56

General

  • Target

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2.exe

  • Size

    141KB

  • MD5

    889270a067578729a4c7cbf0160d4a75

  • SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

  • SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

  • SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • SSDEEP

    3072:A4YNSelXjMy8gYIeeLcmNlgkXSqfWMYnYZfYJbaf8z2WCmW:A4mcgxeeLcmNy9aWMYEfTWc

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Executes dropped EXE 8 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 16 IoCs
  • Maps connected drives based on registry 3 TTPs 10 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 12 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2.exe
    "C:\Users\Admin\AppData\Local\Temp\92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\Temp\92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2.exe
      "C:\Users\Admin\AppData\Local\Temp\92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2.exe"
      2⤵
      • Loads dropped DLL
      • Maps connected drives based on registry
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Windows\SysWOW64\igfxck32.exe
        "C:\Windows\system32\igfxck32.exe" C:\Users\Admin\AppData\Local\Temp\92E875~1.EXE
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:952
        • C:\Windows\SysWOW64\igfxck32.exe
          "C:\Windows\system32\igfxck32.exe" C:\Users\Admin\AppData\Local\Temp\92E875~1.EXE
          4⤵
          • Executes dropped EXE
          • Deletes itself
          • Loads dropped DLL
          • Maps connected drives based on registry
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:592
          • C:\Windows\SysWOW64\igfxck32.exe
            "C:\Windows\system32\igfxck32.exe" C:\Windows\SysWOW64\igfxck32.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1544
            • C:\Windows\SysWOW64\igfxck32.exe
              "C:\Windows\system32\igfxck32.exe" C:\Windows\SysWOW64\igfxck32.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Maps connected drives based on registry
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1032
              • C:\Windows\SysWOW64\igfxck32.exe
                "C:\Windows\system32\igfxck32.exe" C:\Windows\SysWOW64\igfxck32.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:808
                • C:\Windows\SysWOW64\igfxck32.exe
                  "C:\Windows\system32\igfxck32.exe" C:\Windows\SysWOW64\igfxck32.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Maps connected drives based on registry
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:528
                  • C:\Windows\SysWOW64\igfxck32.exe
                    "C:\Windows\system32\igfxck32.exe" C:\Windows\SysWOW64\igfxck32.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • Suspicious use of WriteProcessMemory
                    PID:1468
                    • C:\Windows\SysWOW64\igfxck32.exe
                      "C:\Windows\system32\igfxck32.exe" C:\Windows\SysWOW64\igfxck32.exe
                      10⤵
                      • Executes dropped EXE
                      • Maps connected drives based on registry
                      • Suspicious behavior: EnumeratesProcesses
                      PID:848

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • C:\Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • C:\Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • C:\Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • C:\Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • C:\Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • C:\Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • C:\Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • C:\Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • \Windows\SysWOW64\igfxck32.exe

    Filesize

    141KB

    MD5

    889270a067578729a4c7cbf0160d4a75

    SHA1

    622c17ca9219ea136e5df786f55cd3cd97212ee4

    SHA256

    92e875cbfd1e8c71d1c72df50e586a23bae16aae68ce73dd390a348ad2d9e3c2

    SHA512

    626dab51cb6806c0c4e3b0e941e7c94982dd5a529eafc642fa441b89dbc80e33a8d3b81842802810a89ce3a995d9c40dd41be1274d29038358ed6e05d8edf7d0

  • memory/528-146-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/528-127-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/528-126-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/592-87-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/592-86-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/592-105-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/848-147-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1032-107-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1032-106-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1032-125-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1632-85-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1632-63-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1632-62-0x0000000075211000-0x0000000075213000-memory.dmp

    Filesize

    8KB

  • memory/1632-65-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1632-61-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1632-58-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1632-57-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1632-64-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1632-55-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1632-66-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1632-54-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB