Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 00:12
Static task
static1
Behavioral task
behavioral1
Sample
efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe
-
Size
109KB
-
MD5
9278081fc31fcc3ed7fe73d3017e356d
-
SHA1
50c5987b0ba5304d0168f9ca7af5ddf383966b3b
-
SHA256
efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb
-
SHA512
076f40ed7a53bcec0df5f9cfaabf3f2a1394ed947835cd0a60c71ee3961aa700bf3d8d6b0272bdc985f62b36eaf38659efcb822e833bb4df5d032fe4ad110a44
-
SSDEEP
1536:CSVVNlLaF/buyVfsR1W5dou71Qx2aUUQk4oWl:HVNEF/bF9sLW5dou7ex2aUdzow
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\msconfig.dat" svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 836 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 2012 explorer.exe 1380 Explorer.EXE 1984 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1480 set thread context of 836 1480 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 27 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 836 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 836 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe 1984 svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 836 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 836 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1380 Explorer.EXE -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE 888 ctfmon.exe 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1380 Explorer.EXE 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1984 svchost.exe 1984 svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1480 wrote to memory of 836 1480 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 27 PID 1480 wrote to memory of 836 1480 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 27 PID 1480 wrote to memory of 836 1480 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 27 PID 1480 wrote to memory of 836 1480 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 27 PID 1480 wrote to memory of 836 1480 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 27 PID 1480 wrote to memory of 836 1480 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 27 PID 1480 wrote to memory of 836 1480 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 27 PID 1480 wrote to memory of 836 1480 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 27 PID 1480 wrote to memory of 836 1480 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 27 PID 836 wrote to memory of 2012 836 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 28 PID 836 wrote to memory of 2012 836 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 28 PID 836 wrote to memory of 2012 836 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 28 PID 836 wrote to memory of 2012 836 efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe 28 PID 2012 wrote to memory of 1380 2012 explorer.exe 20 PID 1380 wrote to memory of 1984 1380 Explorer.EXE 29 PID 1380 wrote to memory of 1984 1380 Explorer.EXE 29 PID 1380 wrote to memory of 1984 1380 Explorer.EXE 29 PID 1380 wrote to memory of 1984 1380 Explorer.EXE 29 PID 1380 wrote to memory of 1984 1380 Explorer.EXE 29 PID 1984 wrote to memory of 888 1984 svchost.exe 30 PID 1984 wrote to memory of 888 1984 svchost.exe 30 PID 1984 wrote to memory of 888 1984 svchost.exe 30 PID 1984 wrote to memory of 888 1984 svchost.exe 30
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe"C:\Users\Admin\AppData\Local\Temp\efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe"C:\Users\Admin\AppData\Local\Temp\efdc2582d26e5e452c01bb2b7561ec760176f49f7d17a31bee41480af9933ddb.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2012
-
-
-
-
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe3⤵
- Suspicious use of FindShellTrayWindow
PID:888
-
-