Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 02:18
Static task
static1
Behavioral task
behavioral1
Sample
83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe
Resource
win10v2004-20221111-en
General
-
Target
83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe
-
Size
364KB
-
MD5
8f4eaf1a248c91290da496a039aae41c
-
SHA1
36801dc7302cc07886e01127d301946d8b1fa0ee
-
SHA256
83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7
-
SHA512
b1e8db84116d6d4a758d30be82b9cbf3efd2e7a331bf83ec15dd34cc25f25e6c3a126d7e2e1b85fe226b6fed4c3cf208b8d1acabf9b44118f2644f6201efbc5c
-
SSDEEP
6144:zVNi6V+6v611GM+oY+aqw/Vdlc5HTcF/IntW2sKKth:ZNqF6en2/m1a/2sKKt
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" F4D55F6500014973000B9D42B4EB2331.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2028 F4D55F6500014973000B9D42B4EB2331.exe -
Deletes itself 1 IoCs
pid Process 2028 F4D55F6500014973000B9D42B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 1228 83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe 1228 83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000B9D42B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000B9D42B4EB2331.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" F4D55F6500014973000B9D42B4EB2331.exe -
Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\open F4D55F6500014973000B9D42B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\open\command\ = "\"C:\\ProgramData\\F4D55F6500014973000B9D42B4EB2331\\F4D55F6500014973000B9D42B4EB2331.exe\" -s \"%1\" %*" F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\start\command F4D55F6500014973000B9D42B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.exe\ = "F4D55" F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\DefaultIcon F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\open\command F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell F4D55F6500014973000B9D42B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\%s\ = "F4D55" F4D55F6500014973000B9D42B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\open\command\IsolatedCommand = "\"%1\" %*" F4D55F6500014973000B9D42B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\start\command\IsolatedCommand = "\"%1\" %*" F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\runas\command F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\start F4D55F6500014973000B9D42B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\start\command\ = "\"%1\" %*" F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.exe F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55 F4D55F6500014973000B9D42B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\Content Type = "application/x-msdownload" F4D55F6500014973000B9D42B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\DefaultIcon\ = "%1" F4D55F6500014973000B9D42B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\runas\command\IsolatedCommand = "\"%1\" %*" F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\%s F4D55F6500014973000B9D42B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\ = "Application" F4D55F6500014973000B9D42B4EB2331.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\runas F4D55F6500014973000B9D42B4EB2331.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\F4D55\shell\runas\command\ = "\"%1\" %*" F4D55F6500014973000B9D42B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1228 83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2028 F4D55F6500014973000B9D42B4EB2331.exe 2028 F4D55F6500014973000B9D42B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1228 wrote to memory of 2028 1228 83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe 28 PID 1228 wrote to memory of 2028 1228 83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe 28 PID 1228 wrote to memory of 2028 1228 83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe 28 PID 1228 wrote to memory of 2028 1228 83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe 28 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" F4D55F6500014973000B9D42B4EB2331.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe"C:\Users\Admin\AppData\Local\Temp\83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\ProgramData\F4D55F6500014973000B9D42B4EB2331\F4D55F6500014973000B9D42B4EB2331.exe"C:\ProgramData\F4D55F6500014973000B9D42B4EB2331\F4D55F6500014973000B9D42B4EB2331.exe" -d "C:\Users\Admin\AppData\Local\Temp\83202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7.exe"2⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2028
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
364KB
MD58f4eaf1a248c91290da496a039aae41c
SHA136801dc7302cc07886e01127d301946d8b1fa0ee
SHA25683202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7
SHA512b1e8db84116d6d4a758d30be82b9cbf3efd2e7a331bf83ec15dd34cc25f25e6c3a126d7e2e1b85fe226b6fed4c3cf208b8d1acabf9b44118f2644f6201efbc5c
-
Filesize
364KB
MD58f4eaf1a248c91290da496a039aae41c
SHA136801dc7302cc07886e01127d301946d8b1fa0ee
SHA25683202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7
SHA512b1e8db84116d6d4a758d30be82b9cbf3efd2e7a331bf83ec15dd34cc25f25e6c3a126d7e2e1b85fe226b6fed4c3cf208b8d1acabf9b44118f2644f6201efbc5c
-
Filesize
364KB
MD58f4eaf1a248c91290da496a039aae41c
SHA136801dc7302cc07886e01127d301946d8b1fa0ee
SHA25683202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7
SHA512b1e8db84116d6d4a758d30be82b9cbf3efd2e7a331bf83ec15dd34cc25f25e6c3a126d7e2e1b85fe226b6fed4c3cf208b8d1acabf9b44118f2644f6201efbc5c
-
Filesize
364KB
MD58f4eaf1a248c91290da496a039aae41c
SHA136801dc7302cc07886e01127d301946d8b1fa0ee
SHA25683202e6a856837169fff1bedb6fb76db2197411ccb86e33d5aa2c85e693bb4a7
SHA512b1e8db84116d6d4a758d30be82b9cbf3efd2e7a331bf83ec15dd34cc25f25e6c3a126d7e2e1b85fe226b6fed4c3cf208b8d1acabf9b44118f2644f6201efbc5c