Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 11:03
Behavioral task
behavioral1
Sample
84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
General
-
Target
84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe
-
Size
162KB
-
MD5
7474cad685eddfc6aa6b86856fb2448d
-
SHA1
265f559e5b0d352c94a9727b0079758c79c36787
-
SHA256
84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a
-
SHA512
f15ae393fa9a28113709feeeb27459e5b93bc5d90fa62ca62d5a8fbed58dbab8c98647d6bb675602631f2bc01d8bda7b380df773df3ac7282c6fd9ed696a9f41
-
SSDEEP
3072:OGC4mTElLZ9Ig4T2E52U6OyMNPQTHgnW6A4SlU5Mkm/7p9rzk3qq3T:OWmIlLZOg4B52UNpPtnW5HzjkawT
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\gggggg.exe = "C:\\Users\\Admin\\AppData\\Roaming\\gggggg.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
resource yara_rule behavioral2/memory/1756-132-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/1756-144-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Modifies registry key 1 TTPs 4 IoCs
pid Process 3900 reg.exe 4412 reg.exe 4124 reg.exe 4644 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeCreateTokenPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeAssignPrimaryTokenPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeLockMemoryPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeIncreaseQuotaPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeMachineAccountPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeTcbPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeSecurityPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeTakeOwnershipPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeLoadDriverPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeSystemProfilePrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeSystemtimePrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeProfSingleProcessPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeIncBasePriorityPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeCreatePagefilePrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeCreatePermanentPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeBackupPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeRestorePrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeShutdownPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeDebugPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeAuditPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeSystemEnvironmentPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeChangeNotifyPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeRemoteShutdownPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeUndockPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeSyncAgentPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeEnableDelegationPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeManageVolumePrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeImpersonatePrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: SeCreateGlobalPrivilege 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: 31 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: 32 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: 33 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: 34 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe Token: 35 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1756 wrote to memory of 1096 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 76 PID 1756 wrote to memory of 1096 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 76 PID 1756 wrote to memory of 1096 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 76 PID 1756 wrote to memory of 1432 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 77 PID 1756 wrote to memory of 1432 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 77 PID 1756 wrote to memory of 1432 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 77 PID 1756 wrote to memory of 2880 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 78 PID 1756 wrote to memory of 2880 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 78 PID 1756 wrote to memory of 2880 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 78 PID 1756 wrote to memory of 1848 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 82 PID 1756 wrote to memory of 1848 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 82 PID 1756 wrote to memory of 1848 1756 84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe 82 PID 2880 wrote to memory of 4412 2880 cmd.exe 85 PID 2880 wrote to memory of 4412 2880 cmd.exe 85 PID 2880 wrote to memory of 4412 2880 cmd.exe 85 PID 1432 wrote to memory of 4124 1432 cmd.exe 86 PID 1432 wrote to memory of 4124 1432 cmd.exe 86 PID 1432 wrote to memory of 4124 1432 cmd.exe 86 PID 1848 wrote to memory of 3900 1848 cmd.exe 84 PID 1848 wrote to memory of 3900 1848 cmd.exe 84 PID 1848 wrote to memory of 3900 1848 cmd.exe 84 PID 1096 wrote to memory of 4644 1096 cmd.exe 87 PID 1096 wrote to memory of 4644 1096 cmd.exe 87 PID 1096 wrote to memory of 4644 1096 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe"C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:4644
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\84c260351ec9a3cec2273dfc66801f1bf06b6da889fbfc8a980795c0fe8e9a1a.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:4124
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:4412
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\gggggg.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\gggggg.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\gggggg.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\gggggg.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3900
-
-