Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 07:11
Static task
static1
Behavioral task
behavioral1
Sample
b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
Resource
win10v2004-20220812-en
General
-
Target
b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe
-
Size
267KB
-
MD5
295e0a20d9baa8f6565d293a7637f670
-
SHA1
273587911419d798d9d7f16f759c59f69f0972ca
-
SHA256
b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174
-
SHA512
1776d1f016b8f338762fcb05aa6cebf3fe580e71cd368d4e20ec02c8236bcee266d6e3cbe8d2d397a3a04acc339db24ffa81aa9a4b210fb7a2b20c0fe2672eb8
-
SSDEEP
6144:KxZasmAMSle58AP7tmUk09zspjQi6i8xgWzDyQh+f+MmnQ:KBmAMjtPwUVpksvqWzONm
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 628 xXh3ljXkxqqWTwZC.exe 1124 xXh3ljXkxqqWTwZC.exe -
Deletes itself 1 IoCs
pid Process 1124 xXh3ljXkxqqWTwZC.exe -
Loads dropped DLL 4 IoCs
pid Process 1384 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 1384 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 1384 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 1124 xXh3ljXkxqqWTwZC.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ptsfzfw7QjROg = "C:\\ProgramData\\1Y8PwDQR4P\\xXh3ljXkxqqWTwZC.exe" b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1112 set thread context of 1384 1112 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 26 PID 628 set thread context of 1124 628 xXh3ljXkxqqWTwZC.exe 28 PID 1124 set thread context of 1668 1124 xXh3ljXkxqqWTwZC.exe 29 -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1112 wrote to memory of 1384 1112 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 26 PID 1112 wrote to memory of 1384 1112 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 26 PID 1112 wrote to memory of 1384 1112 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 26 PID 1112 wrote to memory of 1384 1112 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 26 PID 1112 wrote to memory of 1384 1112 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 26 PID 1112 wrote to memory of 1384 1112 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 26 PID 1384 wrote to memory of 628 1384 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 27 PID 1384 wrote to memory of 628 1384 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 27 PID 1384 wrote to memory of 628 1384 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 27 PID 1384 wrote to memory of 628 1384 b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe 27 PID 628 wrote to memory of 1124 628 xXh3ljXkxqqWTwZC.exe 28 PID 628 wrote to memory of 1124 628 xXh3ljXkxqqWTwZC.exe 28 PID 628 wrote to memory of 1124 628 xXh3ljXkxqqWTwZC.exe 28 PID 628 wrote to memory of 1124 628 xXh3ljXkxqqWTwZC.exe 28 PID 628 wrote to memory of 1124 628 xXh3ljXkxqqWTwZC.exe 28 PID 628 wrote to memory of 1124 628 xXh3ljXkxqqWTwZC.exe 28 PID 1124 wrote to memory of 1668 1124 xXh3ljXkxqqWTwZC.exe 29 PID 1124 wrote to memory of 1668 1124 xXh3ljXkxqqWTwZC.exe 29 PID 1124 wrote to memory of 1668 1124 xXh3ljXkxqqWTwZC.exe 29 PID 1124 wrote to memory of 1668 1124 xXh3ljXkxqqWTwZC.exe 29 PID 1124 wrote to memory of 1668 1124 xXh3ljXkxqqWTwZC.exe 29 PID 1124 wrote to memory of 1668 1124 xXh3ljXkxqqWTwZC.exe 29 PID 1124 wrote to memory of 1668 1124 xXh3ljXkxqqWTwZC.exe 29 PID 1124 wrote to memory of 1668 1124 xXh3ljXkxqqWTwZC.exe 29 PID 1124 wrote to memory of 1668 1124 xXh3ljXkxqqWTwZC.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe"C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe"C:\Users\Admin\AppData\Local\Temp\b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe"C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:628 -
C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe"C:\ProgramData\1Y8PwDQR4P\xXh3ljXkxqqWTwZC.exe"4⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe"C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe" /i:11245⤵PID:1668
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD5d73b562268e1342ad98d32c7d208859f
SHA147028d6273745af323b35930976ddb58c6b79c21
SHA2560047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776
SHA51228755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0
-
Filesize
267KB
MD5d73b562268e1342ad98d32c7d208859f
SHA147028d6273745af323b35930976ddb58c6b79c21
SHA2560047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776
SHA51228755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0
-
Filesize
267KB
MD5d73b562268e1342ad98d32c7d208859f
SHA147028d6273745af323b35930976ddb58c6b79c21
SHA2560047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776
SHA51228755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0
-
Filesize
267KB
MD5d73b562268e1342ad98d32c7d208859f
SHA147028d6273745af323b35930976ddb58c6b79c21
SHA2560047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776
SHA51228755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0
-
Filesize
267KB
MD5d73b562268e1342ad98d32c7d208859f
SHA147028d6273745af323b35930976ddb58c6b79c21
SHA2560047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776
SHA51228755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0
-
Filesize
267KB
MD5295e0a20d9baa8f6565d293a7637f670
SHA1273587911419d798d9d7f16f759c59f69f0972ca
SHA256b20df5aa10a92b2f0edba6bfa489326960ae91281e5017a4528746248b22c174
SHA5121776d1f016b8f338762fcb05aa6cebf3fe580e71cd368d4e20ec02c8236bcee266d6e3cbe8d2d397a3a04acc339db24ffa81aa9a4b210fb7a2b20c0fe2672eb8
-
Filesize
267KB
MD5d73b562268e1342ad98d32c7d208859f
SHA147028d6273745af323b35930976ddb58c6b79c21
SHA2560047208d3c10812d45d0d4d4c6d7ac81a122e54a77a4e1c232f2a6b09971d776
SHA51228755428e8ee4f202e7ea9b5269e82f8b03c1a6ec839a7e4fd43a4e98b654e4ca44d348cd7598a364f9caa29d5b98688bf25d277a4172fbaff1304c635347dc0