Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    262s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    02/01/2023, 22:17

General

  • Target

    3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe

  • Size

    6.0MB

  • MD5

    42979249e85a0ef1f6c0e4e7a2ab8b13

  • SHA1

    65159abf134bc0578e6bee9efa67cef63fee6199

  • SHA256

    3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b

  • SHA512

    50ed8037ef3904833a323ed169cb269ef622e4209b2ccd2c34ea8f848c9ab53bbf01e26cba7839288225e0204df58b4e073aa13cfab74feb8206f64d18772bcf

  • SSDEEP

    98304:9+G5NKbORL0dqUFFKtm3AhVOyTUATEPhsCf0z1ZMdxE5ofgK/tSaZkLCGYVXVfp:AGiqRhpQAaC+xE5IH/LZuCnf

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe
    "C:\Users\Admin\AppData\Local\Temp\3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:532
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 5 /tn "Quick Assist{D4F4H6S2V5-J7A2D3F4-N5C3D5G4J7K7}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\quickassist.exe"
      2⤵
      • Creates scheduled task(s)
      PID:1716
    • C:\Windows\SysWOW64\schtasks.exe
      /C /Query /XML /TN "Quick Assist{D4F4H6S2V5-J7A2D3F4-N5C3D5G4J7K7}"
      2⤵
        PID:1352
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /tn "Quick Assist{D4F4H6S2V5-J7A2D3F4-N5C3D5G4J7K7}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\4367458697643422"
        2⤵
        • Creates scheduled task(s)
        PID:688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 192
        2⤵
        • Program crash
        PID:1104
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {A72849EC-9AB9-4F93-8D37-422ED2E7CA79} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:964
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\quickassist.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\quickassist.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:1844

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\quickassist.exe

      Filesize

      6.0MB

      MD5

      42979249e85a0ef1f6c0e4e7a2ab8b13

      SHA1

      65159abf134bc0578e6bee9efa67cef63fee6199

      SHA256

      3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b

      SHA512

      50ed8037ef3904833a323ed169cb269ef622e4209b2ccd2c34ea8f848c9ab53bbf01e26cba7839288225e0204df58b4e073aa13cfab74feb8206f64d18772bcf

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\quickassist.exe

      Filesize

      6.0MB

      MD5

      42979249e85a0ef1f6c0e4e7a2ab8b13

      SHA1

      65159abf134bc0578e6bee9efa67cef63fee6199

      SHA256

      3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b

      SHA512

      50ed8037ef3904833a323ed169cb269ef622e4209b2ccd2c34ea8f848c9ab53bbf01e26cba7839288225e0204df58b4e073aa13cfab74feb8206f64d18772bcf

    • memory/532-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

      Filesize

      8KB

    • memory/532-55-0x0000000000400000-0x0000000000D69000-memory.dmp

      Filesize

      9.4MB

    • memory/532-56-0x0000000000400000-0x0000000000D69000-memory.dmp

      Filesize

      9.4MB

    • memory/1844-64-0x0000000000400000-0x0000000000D69000-memory.dmp

      Filesize

      9.4MB

    • memory/1844-65-0x0000000000400000-0x0000000000D69000-memory.dmp

      Filesize

      9.4MB

    • memory/1844-66-0x0000000000400000-0x0000000000D69000-memory.dmp

      Filesize

      9.4MB