Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
262s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/01/2023, 22:17
Static task
static1
Behavioral task
behavioral1
Sample
3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe
Resource
win10-20220812-en
General
-
Target
3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe
-
Size
6.0MB
-
MD5
42979249e85a0ef1f6c0e4e7a2ab8b13
-
SHA1
65159abf134bc0578e6bee9efa67cef63fee6199
-
SHA256
3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b
-
SHA512
50ed8037ef3904833a323ed169cb269ef622e4209b2ccd2c34ea8f848c9ab53bbf01e26cba7839288225e0204df58b4e073aa13cfab74feb8206f64d18772bcf
-
SSDEEP
98304:9+G5NKbORL0dqUFFKtm3AhVOyTUATEPhsCf0z1ZMdxE5ofgK/tSaZkLCGYVXVfp:AGiqRhpQAaC+xE5IH/LZuCnf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1844 quickassist.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 1844 quickassist.exe 1844 quickassist.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1104 532 WerFault.exe 27 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1716 schtasks.exe 688 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 1844 quickassist.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 532 wrote to memory of 1716 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 28 PID 532 wrote to memory of 1716 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 28 PID 532 wrote to memory of 1716 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 28 PID 532 wrote to memory of 1716 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 28 PID 532 wrote to memory of 1352 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 30 PID 532 wrote to memory of 1352 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 30 PID 532 wrote to memory of 1352 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 30 PID 532 wrote to memory of 1352 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 30 PID 532 wrote to memory of 1104 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 33 PID 532 wrote to memory of 1104 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 33 PID 532 wrote to memory of 1104 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 33 PID 532 wrote to memory of 1104 532 3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe 33 PID 964 wrote to memory of 1844 964 taskeng.exe 35 PID 964 wrote to memory of 1844 964 taskeng.exe 35 PID 964 wrote to memory of 1844 964 taskeng.exe 35 PID 964 wrote to memory of 1844 964 taskeng.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe"C:\Users\Admin\AppData\Local\Temp\3557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "Quick Assist{D4F4H6S2V5-J7A2D3F4-N5C3D5G4J7K7}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\quickassist.exe"2⤵
- Creates scheduled task(s)
PID:1716
-
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "Quick Assist{D4F4H6S2V5-J7A2D3F4-N5C3D5G4J7K7}"2⤵PID:1352
-
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /tn "Quick Assist{D4F4H6S2V5-J7A2D3F4-N5C3D5G4J7K7}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\4367458697643422"2⤵
- Creates scheduled task(s)
PID:688
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 1922⤵
- Program crash
PID:1104
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A72849EC-9AB9-4F93-8D37-422ED2E7CA79} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\quickassist.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\QuickAssist\quickassist.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1844
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.0MB
MD542979249e85a0ef1f6c0e4e7a2ab8b13
SHA165159abf134bc0578e6bee9efa67cef63fee6199
SHA2563557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b
SHA51250ed8037ef3904833a323ed169cb269ef622e4209b2ccd2c34ea8f848c9ab53bbf01e26cba7839288225e0204df58b4e073aa13cfab74feb8206f64d18772bcf
-
Filesize
6.0MB
MD542979249e85a0ef1f6c0e4e7a2ab8b13
SHA165159abf134bc0578e6bee9efa67cef63fee6199
SHA2563557b40fe27beb221cbd1f1376a1fcf359775891ac3bf5d4d03ba45b7d16878b
SHA51250ed8037ef3904833a323ed169cb269ef622e4209b2ccd2c34ea8f848c9ab53bbf01e26cba7839288225e0204df58b4e073aa13cfab74feb8206f64d18772bcf