Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

f7437e22fd...f4.exe

windows7-x64

10

f7437e22fd...f4.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    151s
  • max time network
    163s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 20:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f7437e22fdf06fec7d499f362c2d1217eddcf12cf214981bc8b49689bbf942f4.exe

  • Size

    332KB

  • MD5

    8975ed6d41fca450a0cbfd1d917b69a4

  • SHA1

    57c0b3f45b0617b8ef860d4e094bf04e9b92e964

  • SHA256

    f7437e22fdf06fec7d499f362c2d1217eddcf12cf214981bc8b49689bbf942f4

  • SHA512

    2437c7c66479e7eca42e32a504923e5b1037fa23567aa7f00a8117eb6c26a4f721904b8e5858f3762cc43ce84d78ba13156b64e7707db8959a6c10912252ad53

  • SSDEEP

    6144:AQUqwvU+Zm6DDNMzyqRic/tfgo4DIbaZhjp5u+puN+Ra0ZW1a+SqkvpU:wkgMzyg1KIK7u+pOttS/pU

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 17 IoCs
    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7437e22fdf06fec7d499f362c2d1217eddcf12cf214981bc8b49689bbf942f4.exe
    "C:\Users\Admin\AppData\Local\Temp\f7437e22fdf06fec7d499f362c2d1217eddcf12cf214981bc8b49689bbf942f4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Users\Admin\AppData\Local\rua.exe
      "C:\Users\Admin\AppData\Local\rua.exe" -gav C:\Users\Admin\AppData\Local\Temp\f7437e22fdf06fec7d499f362c2d1217eddcf12cf214981bc8b49689bbf942f4.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Deletes itself
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1732
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1212
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x480
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:628

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\rua.exe
    Filesize

    332KB

    MD5

    8975ed6d41fca450a0cbfd1d917b69a4

    SHA1

    57c0b3f45b0617b8ef860d4e094bf04e9b92e964

    SHA256

    f7437e22fdf06fec7d499f362c2d1217eddcf12cf214981bc8b49689bbf942f4

    SHA512

    2437c7c66479e7eca42e32a504923e5b1037fa23567aa7f00a8117eb6c26a4f721904b8e5858f3762cc43ce84d78ba13156b64e7707db8959a6c10912252ad53

    Download Submit

  • \Users\Admin\AppData\Local\rua.exe
    Filesize

    332KB

    MD5

    8975ed6d41fca450a0cbfd1d917b69a4

    SHA1

    57c0b3f45b0617b8ef860d4e094bf04e9b92e964

    SHA256

    f7437e22fdf06fec7d499f362c2d1217eddcf12cf214981bc8b49689bbf942f4

    SHA512

    2437c7c66479e7eca42e32a504923e5b1037fa23567aa7f00a8117eb6c26a4f721904b8e5858f3762cc43ce84d78ba13156b64e7707db8959a6c10912252ad53

    Download Submit

  • memory/1212-73-0x0000000002580000-0x0000000002590000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1212-67-0x000007FEFB581000-0x000007FEFB583000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1732-69-0x0000000000400000-0x00000000005F9000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1732-68-0x0000000000250000-0x000000000025B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1732-70-0x0000000074561000-0x0000000074563000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1732-71-0x0000000000250000-0x000000000025B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1732-72-0x0000000000400000-0x00000000005F9000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1904-59-0x0000000001EB0000-0x0000000002167000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/1904-58-0x0000000000400000-0x00000000005F9000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1904-57-0x0000000000240000-0x000000000024B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/1904-64-0x0000000000400000-0x00000000005F9000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1904-56-0x0000000000401000-0x00000000005F1000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1904-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1904-55-0x0000000000400000-0x00000000005F9000-memory.dmp

    Filesize

    2.0MB

    Download