Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
261s -
max time network
333s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 08:21
Behavioral task
behavioral1
Sample
c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe
Resource
win10v2004-20220901-en
General
-
Target
c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe
-
Size
660KB
-
MD5
0a6be118b6948896b43d693ad04b5b25
-
SHA1
0a07f132077967de5bf68595be61815ab20a1d23
-
SHA256
c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b
-
SHA512
089f05be99bba208633249f9fcd9a442be7c7140d78e4e156cf5f6814da35b94fc92e0c8d20162cf66877d0642f0b71f095a9a43ebc220250b26fe5eb5b9b0f1
-
SSDEEP
12288:qToxtJnVGqjBl/BTJgD4xIeIXutz6SThpBC058KWUXjnDf8jCfqD1oS:xtnUqjBl9JgUxWul6ST3BV58KWUXs2f0
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1584 98D634CF849.exe 1192 98D634CF849.exe 668 I5i699D.exe -
resource yara_rule behavioral1/memory/472-56-0x0000000000400000-0x00000000006DB000-memory.dmp upx behavioral1/memory/472-61-0x0000000000400000-0x00000000006DB000-memory.dmp upx behavioral1/files/0x000a00000001230a-68.dat upx behavioral1/files/0x000a00000001230a-69.dat upx behavioral1/files/0x000a00000001230a-71.dat upx behavioral1/memory/1584-75-0x0000000000400000-0x00000000006DB000-memory.dmp upx behavioral1/files/0x000a00000001230a-76.dat upx behavioral1/files/0x000a00000001230a-79.dat upx behavioral1/memory/1584-81-0x0000000000400000-0x00000000006DB000-memory.dmp upx -
Loads dropped DLL 4 IoCs
pid Process 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 1192 98D634CF849.exe 1192 98D634CF849.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN I5i699D.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WGZC6D2B1C1D5BZJF = "C:\\RECYCLER\\98D634CF849.exe /q" I5i699D.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 472 set thread context of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 1584 set thread context of 1192 1584 98D634CF849.exe 30 -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PhishingFilter I5i699D.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" I5i699D.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ShownServiceDownBalloon = "0" I5i699D.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery I5i699D.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\ClearBrowsingHistoryOnExit = "0" I5i699D.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 1192 98D634CF849.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe 668 I5i699D.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe Token: SeDebugPrivilege 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe Token: SeDebugPrivilege 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe Token: SeDebugPrivilege 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe Token: SeDebugPrivilege 1192 98D634CF849.exe Token: SeDebugPrivilege 1192 98D634CF849.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe Token: SeDebugPrivilege 668 I5i699D.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 1584 98D634CF849.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 472 wrote to memory of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 472 wrote to memory of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 472 wrote to memory of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 472 wrote to memory of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 472 wrote to memory of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 472 wrote to memory of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 472 wrote to memory of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 472 wrote to memory of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 472 wrote to memory of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 472 wrote to memory of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 472 wrote to memory of 848 472 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 28 PID 848 wrote to memory of 1584 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 29 PID 848 wrote to memory of 1584 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 29 PID 848 wrote to memory of 1584 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 29 PID 848 wrote to memory of 1584 848 c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe 29 PID 1584 wrote to memory of 1192 1584 98D634CF849.exe 30 PID 1584 wrote to memory of 1192 1584 98D634CF849.exe 30 PID 1584 wrote to memory of 1192 1584 98D634CF849.exe 30 PID 1584 wrote to memory of 1192 1584 98D634CF849.exe 30 PID 1584 wrote to memory of 1192 1584 98D634CF849.exe 30 PID 1584 wrote to memory of 1192 1584 98D634CF849.exe 30 PID 1584 wrote to memory of 1192 1584 98D634CF849.exe 30 PID 1584 wrote to memory of 1192 1584 98D634CF849.exe 30 PID 1584 wrote to memory of 1192 1584 98D634CF849.exe 30 PID 1584 wrote to memory of 1192 1584 98D634CF849.exe 30 PID 1584 wrote to memory of 1192 1584 98D634CF849.exe 30 PID 1192 wrote to memory of 668 1192 98D634CF849.exe 31 PID 1192 wrote to memory of 668 1192 98D634CF849.exe 31 PID 1192 wrote to memory of 668 1192 98D634CF849.exe 31 PID 1192 wrote to memory of 668 1192 98D634CF849.exe 31 PID 1192 wrote to memory of 668 1192 98D634CF849.exe 31 PID 1192 wrote to memory of 668 1192 98D634CF849.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe"C:\Users\Admin\AppData\Local\Temp\c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe"C:\Users\Admin\AppData\Local\Temp\c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\RECYCLER\98D634CF849.exe"C:\RECYCLER\98D634CF849.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\RECYCLER\98D634CF849.exe"C:\RECYCLER\98D634CF849.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\I5i699D.exe"C:\Users\Admin\AppData\Local\Temp\I5i699D.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
386KB
MD5a7c665e809404c46db7262f74371e856
SHA1c5c2f5222d239fa7025c81246609b8b23e007849
SHA25604192525765473c5fc80b59ffcb0bd3b6a03917f348b6b8f74b82b4545ce2cba
SHA512e7b9155e1b0c132c2634b42e21ca4fedaa807e7222400ebf8f93157c87b9b619623f78d64f4fde4ce4f04ca4d4af9e31f043e9d41674233458b8e0507d22e3ba
-
Filesize
660KB
MD50a6be118b6948896b43d693ad04b5b25
SHA10a07f132077967de5bf68595be61815ab20a1d23
SHA256c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b
SHA512089f05be99bba208633249f9fcd9a442be7c7140d78e4e156cf5f6814da35b94fc92e0c8d20162cf66877d0642f0b71f095a9a43ebc220250b26fe5eb5b9b0f1
-
Filesize
660KB
MD50a6be118b6948896b43d693ad04b5b25
SHA10a07f132077967de5bf68595be61815ab20a1d23
SHA256c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b
SHA512089f05be99bba208633249f9fcd9a442be7c7140d78e4e156cf5f6814da35b94fc92e0c8d20162cf66877d0642f0b71f095a9a43ebc220250b26fe5eb5b9b0f1
-
Filesize
660KB
MD50a6be118b6948896b43d693ad04b5b25
SHA10a07f132077967de5bf68595be61815ab20a1d23
SHA256c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b
SHA512089f05be99bba208633249f9fcd9a442be7c7140d78e4e156cf5f6814da35b94fc92e0c8d20162cf66877d0642f0b71f095a9a43ebc220250b26fe5eb5b9b0f1
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be
-
Filesize
660KB
MD50a6be118b6948896b43d693ad04b5b25
SHA10a07f132077967de5bf68595be61815ab20a1d23
SHA256c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b
SHA512089f05be99bba208633249f9fcd9a442be7c7140d78e4e156cf5f6814da35b94fc92e0c8d20162cf66877d0642f0b71f095a9a43ebc220250b26fe5eb5b9b0f1
-
Filesize
660KB
MD50a6be118b6948896b43d693ad04b5b25
SHA10a07f132077967de5bf68595be61815ab20a1d23
SHA256c7a6285c8ef2fa0ae7f77b7d431fbbae0bd06092da8569866794d9164d97c08b
SHA512089f05be99bba208633249f9fcd9a442be7c7140d78e4e156cf5f6814da35b94fc92e0c8d20162cf66877d0642f0b71f095a9a43ebc220250b26fe5eb5b9b0f1
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be