Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 13:37
Static task
static1
Behavioral task
behavioral1
Sample
29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe
Resource
win10v2004-20220812-en
General
-
Target
29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe
-
Size
839KB
-
MD5
3736c418a5a3c2d9deba7766881c17f9
-
SHA1
5c5ecf31c34d36b819fc1083d2070cd09d1970ae
-
SHA256
29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02
-
SHA512
3279e4a01e08ddfefbade6e2920a48af3b2e146c824ce8142c1ae2a32b629a47d66695dcf89d324b13e2d71ab400f72a425f8d6ed587417a4164983d4852eb15
-
SSDEEP
12288:whkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a28x7A6:4RmJkcoQricOIQxiZY1ia28x7L
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\15949 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mstouravo.pif" svchost.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1612 netsh.exe -
Deletes itself 1 IoCs
pid Process 1680 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windowsrepair32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\29B836~1.EXE" 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1032 set thread context of 1484 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 30 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\mstouravo.pif svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1484 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1484 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 1484 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1612 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 28 PID 1032 wrote to memory of 1612 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 28 PID 1032 wrote to memory of 1612 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 28 PID 1032 wrote to memory of 1612 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 28 PID 1032 wrote to memory of 1484 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 30 PID 1032 wrote to memory of 1484 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 30 PID 1032 wrote to memory of 1484 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 30 PID 1032 wrote to memory of 1484 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 30 PID 1032 wrote to memory of 1484 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 30 PID 1032 wrote to memory of 1484 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 30 PID 1032 wrote to memory of 1484 1032 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 30 PID 1484 wrote to memory of 1680 1484 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 31 PID 1484 wrote to memory of 1680 1484 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 31 PID 1484 wrote to memory of 1680 1484 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 31 PID 1484 wrote to memory of 1680 1484 29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe"C:\Users\Admin\AppData\Local\Temp\29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe"2⤵
- Modifies Windows Firewall
PID:1612
-
-
C:\Users\Admin\AppData\Local\Temp\29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe"C:\Users\Admin\AppData\Local\Temp\29b8362241e3914bf9b9923f12a07f7a024bc6d9d390c8262197984f796f8e02.exe"2⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\syswow64\svchost.exeC:\Windows\syswow64\svchost.exe3⤵
- Adds policy Run key to start application
- Deletes itself
- Drops file in Program Files directory
PID:1680
-
-