Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/12/2022, 20:11
Behavioral task
behavioral1
Sample
1B8406FD53D3EFE2E48DDB665B3AD38B2ED56EA8554B1.exe
Resource
win7-20220812-en
General
-
Target
1B8406FD53D3EFE2E48DDB665B3AD38B2ED56EA8554B1.exe
-
Size
16.9MB
-
MD5
4363a033ca0d3926b5660a23dbac5443
-
SHA1
6e9be146051594d8745ec3ad52b1976b38f2933b
-
SHA256
1b8406fd53d3efe2e48ddb665b3ad38b2ed56ea8554b147ca9d73d636ce19fa5
-
SHA512
5484bf0367f801c9de2fb6d4da955572d90332ad26fc2c243638c14566a67bc6de4e57d05f53c992f50a1845d57e873bfc97b2b23e05b5aa882da4af7c895042
-
SSDEEP
393216:4uDuv/ef+TC7J50c07ex18ykc5hpiNs+ykHfe9fvPRvsw:Ov/e7J67eD8yHvpos+LHMvPZ
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1600 rfusclient.exe 624 rutserv.exe 920 rutserv.exe 1764 rfusclient.exe -
resource yara_rule behavioral1/memory/1076-55-0x0000000000400000-0x000000000290F000-memory.dmp upx behavioral1/memory/1076-70-0x0000000000400000-0x000000000290F000-memory.dmp upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation rfusclient.exe Key value queried \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation rutserv.exe -
Loads dropped DLL 9 IoCs
pid Process 1076 1B8406FD53D3EFE2E48DDB665B3AD38B2ED56EA8554B1.exe 1600 rfusclient.exe 1600 rfusclient.exe 1600 rfusclient.exe 1600 rfusclient.exe 624 rutserv.exe 624 rutserv.exe 920 rutserv.exe 920 rutserv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 4 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\SysWOW64\ieframe.dll,-5723 = "The Internet" rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\prnfldr.dll,-8036 = "Printers" rutserv.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\NetworkExplorer.dll,-1 = "Network" rutserv.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1600 rfusclient.exe 1600 rfusclient.exe 624 rutserv.exe 624 rutserv.exe 624 rutserv.exe 624 rutserv.exe 624 rutserv.exe 624 rutserv.exe 920 rutserv.exe 920 rutserv.exe 920 rutserv.exe 920 rutserv.exe 920 rutserv.exe 920 rutserv.exe 1764 rfusclient.exe 1764 rfusclient.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 624 rutserv.exe Token: SeTakeOwnershipPrivilege 920 rutserv.exe Token: SeTcbPrivilege 920 rutserv.exe Token: SeTcbPrivilege 920 rutserv.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1764 rfusclient.exe 1764 rfusclient.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1764 rfusclient.exe 1764 rfusclient.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 624 rutserv.exe 624 rutserv.exe 624 rutserv.exe 624 rutserv.exe 920 rutserv.exe 920 rutserv.exe 920 rutserv.exe 920 rutserv.exe 920 rutserv.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1076 wrote to memory of 1600 1076 1B8406FD53D3EFE2E48DDB665B3AD38B2ED56EA8554B1.exe 28 PID 1076 wrote to memory of 1600 1076 1B8406FD53D3EFE2E48DDB665B3AD38B2ED56EA8554B1.exe 28 PID 1076 wrote to memory of 1600 1076 1B8406FD53D3EFE2E48DDB665B3AD38B2ED56EA8554B1.exe 28 PID 1076 wrote to memory of 1600 1076 1B8406FD53D3EFE2E48DDB665B3AD38B2ED56EA8554B1.exe 28 PID 1600 wrote to memory of 624 1600 rfusclient.exe 29 PID 1600 wrote to memory of 624 1600 rfusclient.exe 29 PID 1600 wrote to memory of 624 1600 rfusclient.exe 29 PID 1600 wrote to memory of 624 1600 rfusclient.exe 29 PID 920 wrote to memory of 1764 920 rutserv.exe 31 PID 920 wrote to memory of 1764 920 rutserv.exe 31 PID 920 wrote to memory of 1764 920 rutserv.exe 31 PID 920 wrote to memory of 1764 920 rutserv.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1B8406FD53D3EFE2E48DDB665B3AD38B2ED56EA8554B1.exe"C:\Users\Admin\AppData\Local\Temp\1B8406FD53D3EFE2E48DDB665B3AD38B2ED56EA8554B1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\D70592A31B\rfusclient.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70170\D70592A31B\rfusclient.exe" -run_agent2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\D70592A31B\rutserv.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70170\D70592A31B\rutserv.exe" -run_agent3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:624 -
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\D70592A31B\rutserv.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70170\D70592A31B\rutserv.exe" -run_agent -second4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Roaming\RMS Agent\70170\D70592A31B\rfusclient.exe"C:\Users\Admin\AppData\Roaming\RMS Agent\70170\D70592A31B\rfusclient.exe" /tray /user5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1764
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336B
MD586a73a0c178764cf00e3b98d9cee59f7
SHA1ef5f64f257f3f5367642eed94b2484c0be7aa765
SHA2561d2f8dc869df0dcd0e4aad4b8b91a0b6ebde48329b7a5c70996b2dd8e448f22d
SHA5127154e71a75db43af02f2cd739bbdad936ba9e712acf81b537ab5a2885959d9eb43c26a0d3d19d0ecd8dc75021fc8267039ed884f46345f8136ba596b6924aa27
-
Filesize
51KB
MD54e84df6558c385bc781cddea34c9fba3
SHA16d63d87c19c11bdbfa484a5835ffffd7647296c8
SHA2560526073f28a3b5999528bfa0e680d668922499124f783f02c52a3b25c367ef6d
SHA512c35da0744568bfffeff09e6590d059e91e5d380c5feb3a0fbc5b19477ceca007a882884a7033345ce408fce1deac5248ad9b046656478d734fe494b787f8a9f2
-
Filesize
1.3MB
MD55222eaf78313758b0520be16e3f8392e
SHA19c7cc8fb340618fef38422cf0c75c4c9bfb216e2
SHA2564771b71a48190504094d104087dd431c1c40bde6fad0338a86aa42f7f2a457a5
SHA512459503146f963c64777c56176e480e3334c5bcff2bfef14fc2925b38f1f32117c387dc957789e1691a68798c004c9e672460bda51edcc7b45fb0e1553bf66812
-
Filesize
3KB
MD5af20dbf59fc209b2f1b308a71dfd3603
SHA128c3a322098423b345db2d742621c1262b9f396c
SHA256ad310671e5afdc2f6e2b42cbfddf0b0391585654cc84c7b22e551cb3a2056133
SHA512e86c35b829e6c7016a07b1a9d92b2dc01d992622841aaf0ee55bbb8f99ccd71bcd8187fabe500f926c350a3759bdfd9c439df44d0f98a3588b3a2934681c8096
-
Filesize
10.2MB
MD506208aa91f0f77d6c9b989f65803382a
SHA175e37439e6d1537fadf38c758df3a9fb232313cf
SHA256d576d6fcfdae0ac29d5b040847929b2f8a83436f6b2160a88e8c5ebc119654c5
SHA512a31e9c4c860873155690b90fb8f6d9ca30b084aa32ac94bb7e8ad90ca8d6d89349dc4924eafb2b689ef9ebaf5faa264d9f6c062818d844d17baae7793ba2ec1e
-
Filesize
10.2MB
MD506208aa91f0f77d6c9b989f65803382a
SHA175e37439e6d1537fadf38c758df3a9fb232313cf
SHA256d576d6fcfdae0ac29d5b040847929b2f8a83436f6b2160a88e8c5ebc119654c5
SHA512a31e9c4c860873155690b90fb8f6d9ca30b084aa32ac94bb7e8ad90ca8d6d89349dc4924eafb2b689ef9ebaf5faa264d9f6c062818d844d17baae7793ba2ec1e
-
Filesize
10.2MB
MD506208aa91f0f77d6c9b989f65803382a
SHA175e37439e6d1537fadf38c758df3a9fb232313cf
SHA256d576d6fcfdae0ac29d5b040847929b2f8a83436f6b2160a88e8c5ebc119654c5
SHA512a31e9c4c860873155690b90fb8f6d9ca30b084aa32ac94bb7e8ad90ca8d6d89349dc4924eafb2b689ef9ebaf5faa264d9f6c062818d844d17baae7793ba2ec1e
-
Filesize
19.8MB
MD541dc282cbf89b0737ae6dd2de5a71015
SHA14aac4bafaf43be690089549584770f9e88630b45
SHA256b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c
SHA512ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d
-
Filesize
19.8MB
MD541dc282cbf89b0737ae6dd2de5a71015
SHA14aac4bafaf43be690089549584770f9e88630b45
SHA256b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c
SHA512ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d
-
Filesize
19.8MB
MD541dc282cbf89b0737ae6dd2de5a71015
SHA14aac4bafaf43be690089549584770f9e88630b45
SHA256b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c
SHA512ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d
-
Filesize
7KB
MD5d139df24024830515f6d104b1562ff17
SHA194a86ce2fcd8eff9c7cd5a5ca64267377861b087
SHA256db35b72d466423f7eb998330d7b94fe5297b594795161237e7919002cd354056
SHA512ef6fe7d838f25b5ab242ac605521ca954fa4de3df5652f3ae8a461172351f830aebb9f3cd37efd5ca432a7899139924b760feec6a425948a87abd832f251848a
-
Filesize
337KB
MD590a4b7fc6807693e68dd32b68614d989
SHA1785484ef531ca90f323d5b017fefcff05e68093a
SHA2564f475bd6235d2f761f6c6dbdf3f4b2f35fc6a3787e6b1b28a1912e85cb9be2f6
SHA51297b970cb24774f141042149ac53e45b3fc42f9ce911c0ca774aa3812f48d7744434bf31d217b2a8522439d0e3f71048cc916556c18a71be61b203c942373a81c
-
Filesize
379KB
MD5e247666cdea63da5a95aebc135908207
SHA14642f6c3973c41b7d1c9a73111a26c2d7ac9c392
SHA256b419ed0374e3789b4f83d4af601f796d958e366562a0aaea5d2f81e82abdcf33
SHA51206da11e694d5229783cfb058dcd04d855a1d0758beeaa97bcd886702a1502d0bf542e7890aa8f2e401be36ccf70376b5c091a5d328bb1abe738bc0798ab98a54
-
Filesize
1.6MB
MD5d5c2a6ac30e76b7c9b55adf1fe5c1e4a
SHA13d841eb48d1a32b511611d4b9e6eed71e2c373ee
SHA25611c7004851e6e6624158990dc8abe3aa517bcab708364d469589ad0ca3dba428
SHA5123c1c7fb535e779ac6c0d5aef2d4e9239f1c27136468738a0bd8587f91b99365a38808be31380be98fd74063d266654a6ac2c2e88861a3fe314a95f1296699e1d
-
Filesize
259KB
MD549c51ace274d7db13caa533880869a4a
SHA1b539ed2f1a15e2d4e5c933611d736e0c317b8313
SHA2561d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b
SHA51213440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6
-
Filesize
364KB
MD5eda07083af5b6608cb5b7c305d787842
SHA1d1703c23522d285a3ccdaf7ba2eb837d40608867
SHA256c4683eb09d65d692ca347c0c21f72b086bd2faf733b13234f3a6b28444457d7d
SHA512be5879621d544c4e2c4b0a5db3d93720623e89e841b2982c7f6c99ba58d30167e0dd591a12048ed045f19ec45877aa2ef631b301b903517effa17579c4b7c401
-
Filesize
859KB
MD5642dc7e57f0c962b9db4c8fb346bc5a7
SHA1acee24383b846f7d12521228d69135e5704546f6
SHA25663b4b5db4a96a8abec82b64034f482b433cd4168c960307ac5cc66d2fbf67ede
SHA512fb163a0ce4e3ad0b0a337f5617a7bf59070df05cc433b6463384e8687af3edc197e447609a0d86fe25ba3ee2717fd470f2620a8fc3a2998a7c3b3a40530d0bae
-
Filesize
1.3MB
MD55222eaf78313758b0520be16e3f8392e
SHA19c7cc8fb340618fef38422cf0c75c4c9bfb216e2
SHA2564771b71a48190504094d104087dd431c1c40bde6fad0338a86aa42f7f2a457a5
SHA512459503146f963c64777c56176e480e3334c5bcff2bfef14fc2925b38f1f32117c387dc957789e1691a68798c004c9e672460bda51edcc7b45fb0e1553bf66812
-
Filesize
1.3MB
MD55222eaf78313758b0520be16e3f8392e
SHA19c7cc8fb340618fef38422cf0c75c4c9bfb216e2
SHA2564771b71a48190504094d104087dd431c1c40bde6fad0338a86aa42f7f2a457a5
SHA512459503146f963c64777c56176e480e3334c5bcff2bfef14fc2925b38f1f32117c387dc957789e1691a68798c004c9e672460bda51edcc7b45fb0e1553bf66812
-
Filesize
10.2MB
MD506208aa91f0f77d6c9b989f65803382a
SHA175e37439e6d1537fadf38c758df3a9fb232313cf
SHA256d576d6fcfdae0ac29d5b040847929b2f8a83436f6b2160a88e8c5ebc119654c5
SHA512a31e9c4c860873155690b90fb8f6d9ca30b084aa32ac94bb7e8ad90ca8d6d89349dc4924eafb2b689ef9ebaf5faa264d9f6c062818d844d17baae7793ba2ec1e
-
Filesize
19.8MB
MD541dc282cbf89b0737ae6dd2de5a71015
SHA14aac4bafaf43be690089549584770f9e88630b45
SHA256b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c
SHA512ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d
-
Filesize
19.8MB
MD541dc282cbf89b0737ae6dd2de5a71015
SHA14aac4bafaf43be690089549584770f9e88630b45
SHA256b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c
SHA512ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d
-
Filesize
19.8MB
MD541dc282cbf89b0737ae6dd2de5a71015
SHA14aac4bafaf43be690089549584770f9e88630b45
SHA256b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c
SHA512ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d
-
Filesize
19.8MB
MD541dc282cbf89b0737ae6dd2de5a71015
SHA14aac4bafaf43be690089549584770f9e88630b45
SHA256b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c
SHA512ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d
-
Filesize
337KB
MD590a4b7fc6807693e68dd32b68614d989
SHA1785484ef531ca90f323d5b017fefcff05e68093a
SHA2564f475bd6235d2f761f6c6dbdf3f4b2f35fc6a3787e6b1b28a1912e85cb9be2f6
SHA51297b970cb24774f141042149ac53e45b3fc42f9ce911c0ca774aa3812f48d7744434bf31d217b2a8522439d0e3f71048cc916556c18a71be61b203c942373a81c
-
Filesize
337KB
MD590a4b7fc6807693e68dd32b68614d989
SHA1785484ef531ca90f323d5b017fefcff05e68093a
SHA2564f475bd6235d2f761f6c6dbdf3f4b2f35fc6a3787e6b1b28a1912e85cb9be2f6
SHA51297b970cb24774f141042149ac53e45b3fc42f9ce911c0ca774aa3812f48d7744434bf31d217b2a8522439d0e3f71048cc916556c18a71be61b203c942373a81c