Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 19:37
Behavioral task
behavioral1
Sample
e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe
-
Size
56KB
-
MD5
1a5c255790c9271406af6645cecd03ab
-
SHA1
3f652df3c9ce1cd45e07a530a84575178adec76e
-
SHA256
e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b
-
SHA512
c713bda3e8b925f24c5cff63ba932adc17c99e073941bfdbb98a1a99bc3e6f0f8b5ab70b316c585f430fa48766e1079522e99f5f8e86a3ce5e01076a14ab3f3e
-
SSDEEP
1536:9RL6RMnU+DNu1wRvhrvNIxAKQcxu4h2mGs1SECzKiGgnouy8I:9RL6uU+DNTNhpytxpxYsizoutI
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\ProgramData\\22CC6C32.exe" e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\22CC6C32.exe" e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe -
resource yara_rule behavioral1/memory/1220-56-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1984-62-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1984-61-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1984-57-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1220-63-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral1/memory/1984-64-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/1984-65-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1220 set thread context of 1984 1220 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 26 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 1984 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1220 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1220 wrote to memory of 1984 1220 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 26 PID 1220 wrote to memory of 1984 1220 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 26 PID 1220 wrote to memory of 1984 1220 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 26 PID 1220 wrote to memory of 1984 1220 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 26 PID 1220 wrote to memory of 1984 1220 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 26 PID 1220 wrote to memory of 1984 1220 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 26 PID 1220 wrote to memory of 1984 1220 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 26 PID 1220 wrote to memory of 1984 1220 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 26 PID 1220 wrote to memory of 1984 1220 e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe"C:\Users\Admin\AppData\Local\Temp\e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exeC:\Users\Admin\AppData\Local\Temp\e649224914858253547ee6ba70732186cec92ef37c52c1408c3ced31340c329b.exe2⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
PID:1984
-