Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
07/01/2023, 23:45
Behavioral task
behavioral1
Sample
b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe
-
Size
463KB
-
MD5
26510f4fb2778e0abaf07613321259db
-
SHA1
bb0b43b556927f838ddb8365058ddbfdd2be5e57
-
SHA256
b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e
-
SHA512
154e401582f1f038302c5573586f9f82bb8d4a0a669a8b1fc6a42067cb8fb7bc943feb9d3bd4d01c5525ae9b197633850e5e33b673e5c9a67ff7746a91ec8aa0
-
SSDEEP
12288:yOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiZ84i31wlEiF4:yq5TfcdHj4fmbfFw+U4
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1108-55-0x0000000000C60000-0x0000000000D79000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MsdUpdate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\MSDUpdate\\MsdUpdate.exe" b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\u: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\v: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\h: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\k: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\m: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\p: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\s: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\t: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\i: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\q: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\x: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\z: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\b: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\e: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\j: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\w: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\y: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\r: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\a: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\f: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\g: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\l: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\n: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe File opened (read-only) \??\o: b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1108-55-0x0000000000C60000-0x0000000000D79000-memory.dmp autoit_exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe"C:\Users\Admin\AppData\Local\Temp\b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e.exe"1⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
PID:1108