Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 14:11
Static task
static1
Behavioral task
behavioral1
Sample
fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe
Resource
win10v2004-20220812-en
General
-
Target
fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe
-
Size
288KB
-
MD5
eb2aefd8d89c2b798efda3c000674954
-
SHA1
f623167734cf586ecd3e0b0a038921aa4b76c9ae
-
SHA256
fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3
-
SHA512
47deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f
-
SSDEEP
6144:+4RKN7o1hYYZyr+fBs6ywacA5AcrbGsKF4WYBCtl8gIHuEBbgDxrR95lumbwxtvp:+4v2VyDq+XAyTFR
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List msconfig11.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\msconfig11.exe" msconfig11.exe -
Executes dropped EXE 3 IoCs
pid Process 268 msconfig11.exe 1700 msconfig11.exe 884 msconfig11.exe -
Loads dropped DLL 2 IoCs
pid Process 668 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 668 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\msconfig11.exe" msconfig11.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run msconfig11.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\msconfig11.exe" msconfig11.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run msconfig11.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe File opened for modification \??\PhysicalDrive0 msconfig11.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1048 set thread context of 948 1048 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 27 PID 948 set thread context of 668 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 28 PID 268 set thread context of 1700 268 msconfig11.exe 30 PID 1700 set thread context of 884 1700 msconfig11.exe 31 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 668 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 884 msconfig11.exe 884 msconfig11.exe 884 msconfig11.exe 884 msconfig11.exe 884 msconfig11.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1048 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 268 msconfig11.exe 1700 msconfig11.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1048 wrote to memory of 948 1048 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 27 PID 1048 wrote to memory of 948 1048 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 27 PID 1048 wrote to memory of 948 1048 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 27 PID 1048 wrote to memory of 948 1048 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 27 PID 1048 wrote to memory of 948 1048 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 27 PID 1048 wrote to memory of 948 1048 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 27 PID 1048 wrote to memory of 948 1048 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 27 PID 1048 wrote to memory of 948 1048 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 27 PID 1048 wrote to memory of 948 1048 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 27 PID 948 wrote to memory of 668 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 28 PID 948 wrote to memory of 668 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 28 PID 948 wrote to memory of 668 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 28 PID 948 wrote to memory of 668 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 28 PID 948 wrote to memory of 668 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 28 PID 948 wrote to memory of 668 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 28 PID 948 wrote to memory of 668 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 28 PID 948 wrote to memory of 668 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 28 PID 948 wrote to memory of 668 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 28 PID 948 wrote to memory of 668 948 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 28 PID 668 wrote to memory of 268 668 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 29 PID 668 wrote to memory of 268 668 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 29 PID 668 wrote to memory of 268 668 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 29 PID 668 wrote to memory of 268 668 fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe 29 PID 268 wrote to memory of 1700 268 msconfig11.exe 30 PID 268 wrote to memory of 1700 268 msconfig11.exe 30 PID 268 wrote to memory of 1700 268 msconfig11.exe 30 PID 268 wrote to memory of 1700 268 msconfig11.exe 30 PID 268 wrote to memory of 1700 268 msconfig11.exe 30 PID 268 wrote to memory of 1700 268 msconfig11.exe 30 PID 268 wrote to memory of 1700 268 msconfig11.exe 30 PID 268 wrote to memory of 1700 268 msconfig11.exe 30 PID 268 wrote to memory of 1700 268 msconfig11.exe 30 PID 1700 wrote to memory of 884 1700 msconfig11.exe 31 PID 1700 wrote to memory of 884 1700 msconfig11.exe 31 PID 1700 wrote to memory of 884 1700 msconfig11.exe 31 PID 1700 wrote to memory of 884 1700 msconfig11.exe 31 PID 1700 wrote to memory of 884 1700 msconfig11.exe 31 PID 1700 wrote to memory of 884 1700 msconfig11.exe 31 PID 1700 wrote to memory of 884 1700 msconfig11.exe 31 PID 1700 wrote to memory of 884 1700 msconfig11.exe 31 PID 1700 wrote to memory of 884 1700 msconfig11.exe 31 PID 1700 wrote to memory of 884 1700 msconfig11.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe"C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe"C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe"2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe"C:\Users\Admin\AppData\Local\Temp\fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3.exe"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Roaming\msconfig11.exe"C:\Users\Admin\AppData\Roaming\msconfig11.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Roaming\msconfig11.exe"C:\Users\Admin\AppData\Roaming\msconfig11.exe"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Roaming\msconfig11.exe"C:\Users\Admin\AppData\Roaming\msconfig11.exe"6⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:884
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD5eb2aefd8d89c2b798efda3c000674954
SHA1f623167734cf586ecd3e0b0a038921aa4b76c9ae
SHA256fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3
SHA51247deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f
-
Filesize
288KB
MD5eb2aefd8d89c2b798efda3c000674954
SHA1f623167734cf586ecd3e0b0a038921aa4b76c9ae
SHA256fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3
SHA51247deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f
-
Filesize
288KB
MD5eb2aefd8d89c2b798efda3c000674954
SHA1f623167734cf586ecd3e0b0a038921aa4b76c9ae
SHA256fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3
SHA51247deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f
-
Filesize
288KB
MD5eb2aefd8d89c2b798efda3c000674954
SHA1f623167734cf586ecd3e0b0a038921aa4b76c9ae
SHA256fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3
SHA51247deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f
-
Filesize
288KB
MD5eb2aefd8d89c2b798efda3c000674954
SHA1f623167734cf586ecd3e0b0a038921aa4b76c9ae
SHA256fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3
SHA51247deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f
-
Filesize
288KB
MD5eb2aefd8d89c2b798efda3c000674954
SHA1f623167734cf586ecd3e0b0a038921aa4b76c9ae
SHA256fbea92aca392eecdf2ce4487d1db63312ba7e4210bbd567f2091b4e45a8046a3
SHA51247deeee57716572ac937b4f31e44b347de1cf4f0457f891134b75ef1f0cb0a68078b33078a692af324e31182dfd427aeafbf2e05de7e8ff34735b07caa89605f