Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 12:34
Behavioral task
behavioral1
Sample
c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe
Resource
win10v2004-20220812-en
General
-
Target
c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe
-
Size
297KB
-
MD5
8b3b917ae185bd8d11e6d3701122b2f5
-
SHA1
4e9f92e82a2f93131f6196aca11031b111c62965
-
SHA256
c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf
-
SHA512
e7d253f78580396e9ce186bcf999da8956016010f23bd5fa03ff4f1a2dbe0c8dff136ef32d8e05680370ba1b1284a22ffd9a0c75c18022457fd7296716fd70c7
-
SSDEEP
6144:VcN8VUCEz65mSt1IdDQPGKT4m29fLC+uaMDtBDSDxexPwE:VcYUxz65mSQdsPGKT/sCvaMDtBuNedwE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1724 paguq.exe -
resource yara_rule behavioral1/files/0x000c000000012315-55.dat upx behavioral1/files/0x000c000000012315-56.dat upx behavioral1/files/0x000c000000012315-58.dat upx behavioral1/files/0x000c000000012315-60.dat upx -
Deletes itself 1 IoCs
pid Process 564 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\Currentversion\Run paguq.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\{7BD94DA8-4FEF-AD4D-5225-887A4931AB67} = "C:\\Users\\Admin\\AppData\\Roaming\\Qyvera\\paguq.exe" paguq.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 964 set thread context of 564 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 29 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Privacy c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe 1724 paguq.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeSecurityPrivilege 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe Token: SeSecurityPrivilege 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe Token: SeSecurityPrivilege 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 964 wrote to memory of 1724 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 28 PID 964 wrote to memory of 1724 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 28 PID 964 wrote to memory of 1724 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 28 PID 964 wrote to memory of 1724 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 28 PID 1724 wrote to memory of 1128 1724 paguq.exe 18 PID 1724 wrote to memory of 1128 1724 paguq.exe 18 PID 1724 wrote to memory of 1128 1724 paguq.exe 18 PID 1724 wrote to memory of 1128 1724 paguq.exe 18 PID 1724 wrote to memory of 1128 1724 paguq.exe 18 PID 1724 wrote to memory of 1192 1724 paguq.exe 17 PID 1724 wrote to memory of 1192 1724 paguq.exe 17 PID 1724 wrote to memory of 1192 1724 paguq.exe 17 PID 1724 wrote to memory of 1192 1724 paguq.exe 17 PID 1724 wrote to memory of 1192 1724 paguq.exe 17 PID 1724 wrote to memory of 1268 1724 paguq.exe 16 PID 1724 wrote to memory of 1268 1724 paguq.exe 16 PID 1724 wrote to memory of 1268 1724 paguq.exe 16 PID 1724 wrote to memory of 1268 1724 paguq.exe 16 PID 1724 wrote to memory of 1268 1724 paguq.exe 16 PID 1724 wrote to memory of 964 1724 paguq.exe 19 PID 1724 wrote to memory of 964 1724 paguq.exe 19 PID 1724 wrote to memory of 964 1724 paguq.exe 19 PID 1724 wrote to memory of 964 1724 paguq.exe 19 PID 1724 wrote to memory of 964 1724 paguq.exe 19 PID 964 wrote to memory of 564 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 29 PID 964 wrote to memory of 564 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 29 PID 964 wrote to memory of 564 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 29 PID 964 wrote to memory of 564 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 29 PID 964 wrote to memory of 564 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 29 PID 964 wrote to memory of 564 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 29 PID 964 wrote to memory of 564 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 29 PID 964 wrote to memory of 564 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 29 PID 964 wrote to memory of 564 964 c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe 29
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe"C:\Users\Admin\AppData\Local\Temp\c1e97786db3e715c619c693c999e64f3999d34d9739bb738bdc20d2cf276f0cf.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Roaming\Qyvera\paguq.exe"C:\Users\Admin\AppData\Roaming\Qyvera\paguq.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1724
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp6757f24d.bat"3⤵
- Deletes itself
PID:564
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1192
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD552e697a16f1161e32a89accceef20e80
SHA17a677ede990a5d0950591bddf64063745dd26f81
SHA256682ae9c37eaf063db58243b8999047c420a3c14e0b6db489a598ff3047e45cdb
SHA5123905639b64b0e5872cb04f758c0e6d66c7de609f60e1a9a5c31824162948c1444e6d5d5d52a0f9862212feb97a58942a4b153f8120650fe4334d4fe13aa19e9f
-
Filesize
398B
MD5fda5d7e81a1367f7513b507651aba641
SHA1ebbcd635f4780b2fedebdcc538beddcc5475d941
SHA256f47b459705cd0f9eed372984d44ccdb685dc030ea4b4bbff61f580abb27de476
SHA5121c07c5f8a0aade28c3a630517f2c46cfa13086d54eb36d8e2cc71c088fe9a2c0cb514ff4e546ea34c268785073570fab7bc57cb276fd5b65fa6aa606680e11b1
-
Filesize
297KB
MD5aaac81d906f7b5cd506c2643c2743551
SHA1b557068227e5023b46b3b17a22ef5d8d4699fd0e
SHA25690474b87bf9ca19171dc7ad866dd63cae13d4dcca7c6e3208020ed2ce39e11f3
SHA5128efca2eb45a4eb5bf9be385ad12b00eacd5ac470e5df2cdd89b4b0263012e25e88d905e475ee70720cb5bf918c2ba91be51363d9747350bd97c812b3db54a9b2
-
Filesize
297KB
MD5aaac81d906f7b5cd506c2643c2743551
SHA1b557068227e5023b46b3b17a22ef5d8d4699fd0e
SHA25690474b87bf9ca19171dc7ad866dd63cae13d4dcca7c6e3208020ed2ce39e11f3
SHA5128efca2eb45a4eb5bf9be385ad12b00eacd5ac470e5df2cdd89b4b0263012e25e88d905e475ee70720cb5bf918c2ba91be51363d9747350bd97c812b3db54a9b2
-
Filesize
297KB
MD5aaac81d906f7b5cd506c2643c2743551
SHA1b557068227e5023b46b3b17a22ef5d8d4699fd0e
SHA25690474b87bf9ca19171dc7ad866dd63cae13d4dcca7c6e3208020ed2ce39e11f3
SHA5128efca2eb45a4eb5bf9be385ad12b00eacd5ac470e5df2cdd89b4b0263012e25e88d905e475ee70720cb5bf918c2ba91be51363d9747350bd97c812b3db54a9b2
-
Filesize
297KB
MD5aaac81d906f7b5cd506c2643c2743551
SHA1b557068227e5023b46b3b17a22ef5d8d4699fd0e
SHA25690474b87bf9ca19171dc7ad866dd63cae13d4dcca7c6e3208020ed2ce39e11f3
SHA5128efca2eb45a4eb5bf9be385ad12b00eacd5ac470e5df2cdd89b4b0263012e25e88d905e475ee70720cb5bf918c2ba91be51363d9747350bd97c812b3db54a9b2