Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 06:08
Behavioral task
behavioral1
Sample
a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe
-
Size
1.4MB
-
MD5
e32c4fbd28f2b996a5a7bbde62f48ce9
-
SHA1
a027c853489fb726f8f2f7286d20f3f1f3f67e94
-
SHA256
a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2
-
SHA512
ae5ccd8f07857143fd88d98fec86458c2874992a70ed3482d56c81ac101bb370a21fb2b8d5c4256c87b222ac26fd8e00a1c3534452fd3dcce590e81817e0293c
-
SSDEEP
24576:nk3lFVBIRSEuzT5aDtcANt9aZ+/JiCXNRDE6mbSy1IndkZVrR8iTH5jaGjSuQ+VJ:k1XBIRSfHANtN7yKndkNf5jaGjw+VK6P
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\drivers\drive.sys.off a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe File created C:\WINDOWS\SysWOW64\drivers\drive.sys a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\drive.sys a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Cuzinho\ImagePath = "system32\\drivers\\drive.sys" a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe -
resource yara_rule behavioral2/memory/676-132-0x0000000011310000-0x0000000012139000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\System32\\avg.exe" a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\avg.exe a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe File opened for modification C:\Windows\SysWOW64\avg.exe a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 5068 reg.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 676 a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found 652 Process not Found -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 676 a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe 676 a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 676 wrote to memory of 2576 676 a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe 83 PID 676 wrote to memory of 2576 676 a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe 83 PID 676 wrote to memory of 2576 676 a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe 83 PID 2576 wrote to memory of 5068 2576 cmd.exe 85 PID 2576 wrote to memory of 5068 2576 cmd.exe 85 PID 2576 wrote to memory of 5068 2576 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe"C:\Users\Admin\AppData\Local\Temp\a0c2ca51c7d65d7615fe8b7318baf7d50bdb4fc161ee05845f8686cd41c752f2.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- Modifies registry key
PID:5068
-
-