Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

f0c0d53a73...74.exe

windows7-x64

10

f0c0d53a73...74.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 11:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f0c0d53a73808a6d54447493ca87b2d58744cc0adb80b086ad547ac17402f674.exe

  • Size

    336KB

  • MD5

    31d8227a0d401e506c54413d54ba7863

  • SHA1

    a6654ff509b40cc9bbaca8b6738407096a20a02e

  • SHA256

    f0c0d53a73808a6d54447493ca87b2d58744cc0adb80b086ad547ac17402f674

  • SHA512

    83c91336cf33f4ff8f481605fa9f4114ca2df9d4b93d1ad566e21fbb28e70797d056e4ee463b21548be9c7248621eb15fcc4c19cc122433eb27f699c766c89ec

  • SSDEEP

    6144:7Jwl7rc4wHHRBFYfDBaphH/J6wOAquppETUaX8ljc2jT:7Wl3c4wSfD4LfMwOOvJaOA

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 17 IoCs
    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Modifies registry class 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0c0d53a73808a6d54447493ca87b2d58744cc0adb80b086ad547ac17402f674.exe
    "C:\Users\Admin\AppData\Local\Temp\f0c0d53a73808a6d54447493ca87b2d58744cc0adb80b086ad547ac17402f674.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:900
    • C:\Users\Admin\AppData\Local\sgg.exe
      "C:\Users\Admin\AppData\Local\sgg.exe" -gav C:\Users\Admin\AppData\Local\Temp\f0c0d53a73808a6d54447493ca87b2d58744cc0adb80b086ad547ac17402f674.exe
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Deletes itself
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1988
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1292
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x58c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1564

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\sgg.exe
    Filesize

    336KB

    MD5

    31d8227a0d401e506c54413d54ba7863

    SHA1

    a6654ff509b40cc9bbaca8b6738407096a20a02e

    SHA256

    f0c0d53a73808a6d54447493ca87b2d58744cc0adb80b086ad547ac17402f674

    SHA512

    83c91336cf33f4ff8f481605fa9f4114ca2df9d4b93d1ad566e21fbb28e70797d056e4ee463b21548be9c7248621eb15fcc4c19cc122433eb27f699c766c89ec

    Download Submit

  • \Users\Admin\AppData\Local\sgg.exe
    Filesize

    336KB

    MD5

    31d8227a0d401e506c54413d54ba7863

    SHA1

    a6654ff509b40cc9bbaca8b6738407096a20a02e

    SHA256

    f0c0d53a73808a6d54447493ca87b2d58744cc0adb80b086ad547ac17402f674

    SHA512

    83c91336cf33f4ff8f481605fa9f4114ca2df9d4b93d1ad566e21fbb28e70797d056e4ee463b21548be9c7248621eb15fcc4c19cc122433eb27f699c766c89ec

    Download Submit

  • \Users\Admin\AppData\Local\sgg.exe
    Filesize

    336KB

    MD5

    31d8227a0d401e506c54413d54ba7863

    SHA1

    a6654ff509b40cc9bbaca8b6738407096a20a02e

    SHA256

    f0c0d53a73808a6d54447493ca87b2d58744cc0adb80b086ad547ac17402f674

    SHA512

    83c91336cf33f4ff8f481605fa9f4114ca2df9d4b93d1ad566e21fbb28e70797d056e4ee463b21548be9c7248621eb15fcc4c19cc122433eb27f699c766c89ec

    Download Submit

  • memory/900-56-0x0000000000401000-0x00000000005E5000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/900-55-0x0000000000400000-0x00000000005EF000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/900-57-0x0000000000230000-0x000000000024C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/900-58-0x0000000000400000-0x00000000005EF000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/900-59-0x0000000002030000-0x00000000022DA000-memory.dmp

    Filesize

    2.7MB

    Download

  • memory/900-54-0x0000000076071000-0x0000000076073000-memory.dmp

    Filesize

    8KB

    Download

  • memory/900-65-0x0000000000400000-0x00000000005EF000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1292-74-0x0000000002C90000-0x0000000002CA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1292-68-0x000007FEFBC41000-0x000007FEFBC43000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1988-69-0x0000000000230000-0x000000000024C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1988-71-0x00000000739B1000-0x00000000739B3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1988-72-0x0000000000230000-0x000000000024C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/1988-73-0x0000000000400000-0x00000000005EF000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1988-70-0x0000000000400000-0x00000000005EF000-memory.dmp

    Filesize

    1.9MB

    Download