Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 10:52
Static task
static1
Behavioral task
behavioral1
Sample
f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe
-
Size
433KB
-
MD5
8c483d31d90cb9c0642eafa94d00b7e3
-
SHA1
c6c3ac38b00091a505c6609fa00db0ee2b3a89e0
-
SHA256
f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc
-
SHA512
e532c5eea5a3f7584aa0fb509eceec2dc5577d31025206f85cb0bb26caba5c9fa6857fa43369cf204d7c7346234f5ebdebf087f82537fbb5d034466b42dc6c16
-
SSDEEP
12288:xZUKXCWhLv9hJ/uB8jKZ67/Nag/HFNyWouSpM5TCI+7roS:vUKyCLvdGB9K/Xfnktp4TCv
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Ebook.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Ebook.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
resource yara_rule behavioral2/memory/1460-136-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/1460-138-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/1460-139-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/1460-144-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/1460-153-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3992 set thread context of 1460 3992 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 80 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 3516 reg.exe 1332 reg.exe 2904 reg.exe 2560 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeCreateTokenPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeAssignPrimaryTokenPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeLockMemoryPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeIncreaseQuotaPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeMachineAccountPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeTcbPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeSecurityPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeTakeOwnershipPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeLoadDriverPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeSystemProfilePrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeSystemtimePrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeProfSingleProcessPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeIncBasePriorityPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeCreatePagefilePrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeCreatePermanentPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeBackupPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeRestorePrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeShutdownPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeDebugPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeAuditPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeSystemEnvironmentPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeChangeNotifyPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeRemoteShutdownPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeUndockPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeSyncAgentPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeEnableDelegationPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeManageVolumePrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeImpersonatePrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: SeCreateGlobalPrivilege 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: 31 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: 32 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: 33 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: 34 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe Token: 35 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3992 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3992 wrote to memory of 1460 3992 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 80 PID 3992 wrote to memory of 1460 3992 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 80 PID 3992 wrote to memory of 1460 3992 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 80 PID 3992 wrote to memory of 1460 3992 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 80 PID 3992 wrote to memory of 1460 3992 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 80 PID 3992 wrote to memory of 1460 3992 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 80 PID 3992 wrote to memory of 1460 3992 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 80 PID 3992 wrote to memory of 1460 3992 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 80 PID 1460 wrote to memory of 4912 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 81 PID 1460 wrote to memory of 4912 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 81 PID 1460 wrote to memory of 4912 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 81 PID 1460 wrote to memory of 4944 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 83 PID 1460 wrote to memory of 4944 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 83 PID 1460 wrote to memory of 4944 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 83 PID 1460 wrote to memory of 4960 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 88 PID 1460 wrote to memory of 4960 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 88 PID 1460 wrote to memory of 4960 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 88 PID 1460 wrote to memory of 1284 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 85 PID 1460 wrote to memory of 1284 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 85 PID 1460 wrote to memory of 1284 1460 f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe 85 PID 4912 wrote to memory of 3516 4912 cmd.exe 89 PID 4912 wrote to memory of 3516 4912 cmd.exe 89 PID 4912 wrote to memory of 3516 4912 cmd.exe 89 PID 4960 wrote to memory of 1332 4960 cmd.exe 90 PID 4960 wrote to memory of 1332 4960 cmd.exe 90 PID 4960 wrote to memory of 1332 4960 cmd.exe 90 PID 1284 wrote to memory of 2904 1284 cmd.exe 91 PID 1284 wrote to memory of 2904 1284 cmd.exe 91 PID 1284 wrote to memory of 2904 1284 cmd.exe 91 PID 4944 wrote to memory of 2560 4944 cmd.exe 92 PID 4944 wrote to memory of 2560 4944 cmd.exe 92 PID 4944 wrote to memory of 2560 4944 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe"C:\Users\Admin\AppData\Local\Temp\f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe"C:\Users\Admin\AppData\Local\Temp\f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:3516
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f1fcd083f8079998648d4b3ea35c42373a3dfa970ac8228442a1717d35fcc9cc.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Ebook.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Ebook.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Ebook.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Ebook.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1332
-
-
-