Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
34s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe
Resource
win10v2004-20220901-en
General
-
Target
b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe
-
Size
54KB
-
MD5
a2b3ecbc0e24649389143edda113ff9a
-
SHA1
130ef89435bc2c7c8cbe21211d9bbaa108d67ffa
-
SHA256
b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed
-
SHA512
630d700769aa2d3b56143fd7fca9957d73eb1e0f56078967fa066a4d85961b0939bc5b35f7bd7972ff1fc1862069f6d198ea2ec284c9a71f0e8bd86a880710e9
-
SSDEEP
1536:3nLvs+iVqGJi+X9cgydqfTP7q0qPYNIFJyW:3DmsAi+X9byrpV3yW
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{958C8EE3-16D5-D9AA-67C0-4045623214AA} b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{958C8EE3-16D5-D9AA-67C0-4045623214AA}\stubpath = "%SystemRoot%\\system32\\GoogleUpdate.exe" b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe -
Deletes itself 1 IoCs
pid Process 1700 cmd.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\GoogleUpdate.exe b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe File opened for modification C:\Windows\SysWOW64\GoogleUpdate.exe b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1144 b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1144 wrote to memory of 1964 1144 b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe 27 PID 1144 wrote to memory of 1964 1144 b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe 27 PID 1144 wrote to memory of 1964 1144 b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe 27 PID 1144 wrote to memory of 1964 1144 b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe 27 PID 1144 wrote to memory of 1700 1144 b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe 31 PID 1144 wrote to memory of 1700 1144 b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe 31 PID 1144 wrote to memory of 1700 1144 b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe 31 PID 1144 wrote to memory of 1700 1144 b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe"C:\Users\Admin\AppData\Local\Temp\b03e462f748c34d97a6c77dca24101f933ee914d151f41743bdbbded0da3d8ed.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\reg.exereg delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\{958C8EE3-16D5-D9AA-67C0-4045623214AA}" /f2⤵PID:1964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\B03E46~1.EXE > nul2⤵
- Deletes itself
PID:1700
-