Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 05:49
Static task
static1
Behavioral task
behavioral1
Sample
cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe
Resource
win7-20221111-en
windows7-x64
20 signatures
150 seconds
General
-
Target
cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe
-
Size
284KB
-
MD5
62fdfc1139c85ea83edf669619caeabf
-
SHA1
2d5ce225911d6b9a45add6be6ef5614b151b72b2
-
SHA256
cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22
-
SHA512
eb66b297f9db9195037a9087643b111651e02b50207b405ee5cfe10a727cebf42d9cfb9be43c6ea2088ef0082a6788410e3764723d574b3835fdef8a9d853b5e
-
SSDEEP
6144:9v/IiVsPjo82vLrkKbGi6qzXQs7c4pDkHKHKWVGANCs5FGWO0:fGjo8UrbGnqzJv1YKHK3AgmC
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1896 69AC.tmp -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
resource yara_rule behavioral1/memory/1360-55-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1276-69-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1276-73-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1184-76-0x0000000000400000-0x000000000046A000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1C9.exe = "C:\\Program Files (x86)\\LP\\1AB0\\1C9.exe" cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\LP\1AB0\69AC.tmp cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe File created C:\Program Files (x86)\LP\1AB0\1C9.exe cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe File opened for modification C:\Program Files (x86)\LP\1AB0\1C9.exe cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 580 explorer.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: 33 364 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 364 AUDIODG.EXE Token: 33 364 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 364 AUDIODG.EXE Token: SeRestorePrivilege 1728 msiexec.exe Token: SeTakeOwnershipPrivilege 1728 msiexec.exe Token: SeSecurityPrivilege 1728 msiexec.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe 580 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1360 wrote to memory of 1896 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 31 PID 1360 wrote to memory of 1896 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 31 PID 1360 wrote to memory of 1896 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 31 PID 1360 wrote to memory of 1896 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 31 PID 1360 wrote to memory of 1276 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 33 PID 1360 wrote to memory of 1276 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 33 PID 1360 wrote to memory of 1276 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 33 PID 1360 wrote to memory of 1276 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 33 PID 1360 wrote to memory of 1184 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 36 PID 1360 wrote to memory of 1184 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 36 PID 1360 wrote to memory of 1184 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 36 PID 1360 wrote to memory of 1184 1360 cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe 36 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe"C:\Users\Admin\AppData\Local\Temp\cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1360 -
C:\Program Files (x86)\LP\1AB0\69AC.tmp"C:\Program Files (x86)\LP\1AB0\69AC.tmp"2⤵
- Executes dropped EXE
PID:1896
-
-
C:\Users\Admin\AppData\Local\Temp\cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exeC:\Users\Admin\AppData\Local\Temp\cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe startC:\Users\Admin\AppData\Roaming\07C40\31D1A.exe%C:\Users\Admin\AppData\Roaming\07C402⤵PID:1276
-
-
C:\Users\Admin\AppData\Local\Temp\cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exeC:\Users\Admin\AppData\Local\Temp\cb0ea71266394dc77b320dc309ffc1226631461a1c6b7a2e7f2766fed9038a22.exe startC:\Program Files (x86)\40764\lvvm.exe%C:\Program Files (x86)\407642⤵PID:1184
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:580
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5881⤵
- Suspicious use of AdjustPrivilegeToken
PID:364
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5c28186290b51a5350bfc382685940af4
SHA1dcc9eb2a2375f81dfb98515c07912ad4028216be
SHA2567315bbc1d631338fffeeec3edb5d64bb6d050c9f390da8bdc7714806b8966eaa
SHA512a94b534cb518097e2b89718bc70c77a9c1c8cc43c302e547b02cf1bad0bbc7cd6bc9bb42dd19823c3cd90389057dc3df62f7c03b7e42066cf49563c86cbdf7e7
-
Filesize
101KB
MD5c28186290b51a5350bfc382685940af4
SHA1dcc9eb2a2375f81dfb98515c07912ad4028216be
SHA2567315bbc1d631338fffeeec3edb5d64bb6d050c9f390da8bdc7714806b8966eaa
SHA512a94b534cb518097e2b89718bc70c77a9c1c8cc43c302e547b02cf1bad0bbc7cd6bc9bb42dd19823c3cd90389057dc3df62f7c03b7e42066cf49563c86cbdf7e7
-
Filesize
101KB
MD5c28186290b51a5350bfc382685940af4
SHA1dcc9eb2a2375f81dfb98515c07912ad4028216be
SHA2567315bbc1d631338fffeeec3edb5d64bb6d050c9f390da8bdc7714806b8966eaa
SHA512a94b534cb518097e2b89718bc70c77a9c1c8cc43c302e547b02cf1bad0bbc7cd6bc9bb42dd19823c3cd90389057dc3df62f7c03b7e42066cf49563c86cbdf7e7