Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 20:06
Static task
static1
Behavioral task
behavioral1
Sample
d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe
Resource
win10v2004-20221111-en
General
-
Target
d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe
-
Size
1.3MB
-
MD5
d101296ac9a37b696df64c3b8745c4de
-
SHA1
fa6180be5f580c5477b4fab3a562cf403eeb604d
-
SHA256
d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05
-
SHA512
cba1c363f01116d0ece17e243fd9b720e6484fa99f8d71554d1df8f227eaa98ce782e199ca2b3e10dc973b24034910315bf1fd74a329e2995a934cf981ad0bcf
-
SSDEEP
24576:oLI2haCRy3CUv1+oZi5hYRTpcNCV6h9CVVfQjwd0ynj67:oLI0y3bMvKxQjwd0ynj67
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 896 setup080.exe 1124 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
pid Process 1864 cmd.exe -
Loads dropped DLL 5 IoCs
pid Process 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 896 setup080.exe 896 setup080.exe 1864 cmd.exe 1864 cmd.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ntshrui.dll setup080.exe File opened for modification C:\Windows\ntshrui.dll setup080.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeShutdownPrivilege 1552 explorer.exe Token: SeShutdownPrivilege 1552 explorer.exe Token: SeShutdownPrivilege 1552 explorer.exe Token: SeShutdownPrivilege 1552 explorer.exe Token: SeShutdownPrivilege 1552 explorer.exe Token: SeShutdownPrivilege 1552 explorer.exe Token: SeShutdownPrivilege 1552 explorer.exe Token: SeShutdownPrivilege 1552 explorer.exe Token: 33 1712 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1712 AUDIODG.EXE Token: 33 1712 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1712 AUDIODG.EXE Token: SeShutdownPrivilege 1552 explorer.exe Token: SeShutdownPrivilege 1552 explorer.exe Token: SeShutdownPrivilege 1552 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe 1552 explorer.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1408 wrote to memory of 896 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 28 PID 1408 wrote to memory of 896 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 28 PID 1408 wrote to memory of 896 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 28 PID 1408 wrote to memory of 896 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 28 PID 1408 wrote to memory of 896 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 28 PID 1408 wrote to memory of 896 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 28 PID 1408 wrote to memory of 896 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 28 PID 896 wrote to memory of 1552 896 setup080.exe 29 PID 896 wrote to memory of 1552 896 setup080.exe 29 PID 896 wrote to memory of 1552 896 setup080.exe 29 PID 896 wrote to memory of 1552 896 setup080.exe 29 PID 1552 wrote to memory of 1764 1552 explorer.exe 30 PID 1552 wrote to memory of 1764 1552 explorer.exe 30 PID 1552 wrote to memory of 1764 1552 explorer.exe 30 PID 1408 wrote to memory of 1864 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 32 PID 1408 wrote to memory of 1864 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 32 PID 1408 wrote to memory of 1864 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 32 PID 1408 wrote to memory of 1864 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 32 PID 1408 wrote to memory of 1864 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 32 PID 1408 wrote to memory of 1864 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 32 PID 1408 wrote to memory of 1864 1408 d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe 32 PID 1864 wrote to memory of 1124 1864 cmd.exe 34 PID 1864 wrote to memory of 1124 1864 cmd.exe 34 PID 1864 wrote to memory of 1124 1864 cmd.exe 34 PID 1864 wrote to memory of 1124 1864 cmd.exe 34 PID 1864 wrote to memory of 1124 1864 cmd.exe 34 PID 1864 wrote to memory of 1124 1864 cmd.exe 34 PID 1864 wrote to memory of 1124 1864 cmd.exe 34 PID 896 wrote to memory of 1616 896 setup080.exe 35 PID 896 wrote to memory of 1616 896 setup080.exe 35 PID 896 wrote to memory of 1616 896 setup080.exe 35 PID 896 wrote to memory of 1616 896 setup080.exe 35 PID 896 wrote to memory of 1616 896 setup080.exe 35 PID 896 wrote to memory of 1616 896 setup080.exe 35 PID 896 wrote to memory of 1616 896 setup080.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe"C:\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\setup080.exeC:\Users\Admin\AppData\Local\Temp\\setup080.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\explorer.exeC:\Windows\explorer.exe3⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:1764
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ERASE /F C:\Users\Admin\AppData\Local\Temp\setup080.exe3⤵PID:1616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\\aa.bat2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe"C:\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe"3⤵
- Executes dropped EXE
PID:1124
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x48c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5b67982870f0de61946a42e0cdf1ccb7b
SHA18881872a7b2328bec6cdbe9e051fc882115dc8d4
SHA256719f11b77cece9693e400ffa8bb60dd4c45deca3e0044d9ac5405652d8492451
SHA512437112579d92fddde0df362278736b7c92fa7685daf489bb3e6c3c8c4e127969f60ecfc18d8ff4db439a4ce6d2a3dfdffe70fabc37df924678745ab59a6968da
-
Filesize
617B
MD5608b136341b1305da56b14576b33b7be
SHA1970af0fd797189d6a2f32f4b8c611c17b717ba06
SHA256a5e6b0b7efb08cb633d99c149d96aca602f10d981d1b1a11b2bdf25c23559ced
SHA512c64300ccda8996e296334a47c6a123c0f99ce8f7a03d1fe240c1706a35f41debe68d0c543aa25f6fd16972654b9a921026af4da72ca0ce3991ab61bc197fd803
-
C:\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe
Filesize1.3MB
MD5b67982870f0de61946a42e0cdf1ccb7b
SHA18881872a7b2328bec6cdbe9e051fc882115dc8d4
SHA256719f11b77cece9693e400ffa8bb60dd4c45deca3e0044d9ac5405652d8492451
SHA512437112579d92fddde0df362278736b7c92fa7685daf489bb3e6c3c8c4e127969f60ecfc18d8ff4db439a4ce6d2a3dfdffe70fabc37df924678745ab59a6968da
-
Filesize
15KB
MD546da55d3a9e9cd858dc3764e248a523c
SHA16b49fd398deb6694a21a54ad919add66dbbce67a
SHA256ca09704d2a911bce2bc25a4d5881390497727c2f0968c0b0cacd8b40521920fc
SHA5120ea972c4fb969aa6921c47feb24ca48aa6ccde28ea51ebbc1aa954f892ea784a092b2781e2e6348eddb44c47bbd7c6bb889d3f850666b96d3ff6e5c5b27828fe
-
Filesize
15KB
MD546da55d3a9e9cd858dc3764e248a523c
SHA16b49fd398deb6694a21a54ad919add66dbbce67a
SHA256ca09704d2a911bce2bc25a4d5881390497727c2f0968c0b0cacd8b40521920fc
SHA5120ea972c4fb969aa6921c47feb24ca48aa6ccde28ea51ebbc1aa954f892ea784a092b2781e2e6348eddb44c47bbd7c6bb889d3f850666b96d3ff6e5c5b27828fe
-
\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe
Filesize1.3MB
MD5b67982870f0de61946a42e0cdf1ccb7b
SHA18881872a7b2328bec6cdbe9e051fc882115dc8d4
SHA256719f11b77cece9693e400ffa8bb60dd4c45deca3e0044d9ac5405652d8492451
SHA512437112579d92fddde0df362278736b7c92fa7685daf489bb3e6c3c8c4e127969f60ecfc18d8ff4db439a4ce6d2a3dfdffe70fabc37df924678745ab59a6968da
-
\Users\Admin\AppData\Local\Temp\d2f0500e611f0d9cb9fb3abac9be2183b341a3a67b6c60216546a71f22274a05.exe
Filesize1.3MB
MD5b67982870f0de61946a42e0cdf1ccb7b
SHA18881872a7b2328bec6cdbe9e051fc882115dc8d4
SHA256719f11b77cece9693e400ffa8bb60dd4c45deca3e0044d9ac5405652d8492451
SHA512437112579d92fddde0df362278736b7c92fa7685daf489bb3e6c3c8c4e127969f60ecfc18d8ff4db439a4ce6d2a3dfdffe70fabc37df924678745ab59a6968da
-
Filesize
15KB
MD546da55d3a9e9cd858dc3764e248a523c
SHA16b49fd398deb6694a21a54ad919add66dbbce67a
SHA256ca09704d2a911bce2bc25a4d5881390497727c2f0968c0b0cacd8b40521920fc
SHA5120ea972c4fb969aa6921c47feb24ca48aa6ccde28ea51ebbc1aa954f892ea784a092b2781e2e6348eddb44c47bbd7c6bb889d3f850666b96d3ff6e5c5b27828fe
-
Filesize
15KB
MD546da55d3a9e9cd858dc3764e248a523c
SHA16b49fd398deb6694a21a54ad919add66dbbce67a
SHA256ca09704d2a911bce2bc25a4d5881390497727c2f0968c0b0cacd8b40521920fc
SHA5120ea972c4fb969aa6921c47feb24ca48aa6ccde28ea51ebbc1aa954f892ea784a092b2781e2e6348eddb44c47bbd7c6bb889d3f850666b96d3ff6e5c5b27828fe
-
Filesize
15KB
MD546da55d3a9e9cd858dc3764e248a523c
SHA16b49fd398deb6694a21a54ad919add66dbbce67a
SHA256ca09704d2a911bce2bc25a4d5881390497727c2f0968c0b0cacd8b40521920fc
SHA5120ea972c4fb969aa6921c47feb24ca48aa6ccde28ea51ebbc1aa954f892ea784a092b2781e2e6348eddb44c47bbd7c6bb889d3f850666b96d3ff6e5c5b27828fe