Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
101s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
10/01/2023, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
27b767470ffaa473d2f8fab45697384791ace44d.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
27b767470ffaa473d2f8fab45697384791ace44d.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
27b767470ffaa473d2f8fab45697384791ace44d.exe
-
Size
432KB
-
MD5
e8f25321c19a0d7e317627b959b3cd7a
-
SHA1
27b767470ffaa473d2f8fab45697384791ace44d
-
SHA256
825f8edaf1db522250a0c8996536c1bb015b0b47a296ea2458f166a7d5b79c03
-
SHA512
de0101f416fbc4086947f8b33ae8b56e1b398b4dafccbbb58ffe8a82b76707bccb66c0c6141a4dc547b9c703a27f9365b2aec09cd25aeae690a90867faf2ca99
-
SSDEEP
6144:ryiMayuNj37jvaJjk8+nc6i54RQ9JDaoUUTcUnuLh8f1CXswxZKEIn:ryiCQ3fnc94Rk3U6uLfZKfn
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 27b767470ffaa473d2f8fab45697384791ace44d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000CAE15B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 27b767470ffaa473d2f8fab45697384791ace44d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 27b767470ffaa473d2f8fab45697384791ace44d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000CAE15B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000CAE15B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000CAE15B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000CAE15B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 27b767470ffaa473d2f8fab45697384791ace44d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 27b767470ffaa473d2f8fab45697384791ace44d.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1664 F4D55F6500014973000CAE15B4EB2331.exe -
Deletes itself 1 IoCs
pid Process 1664 F4D55F6500014973000CAE15B4EB2331.exe -
Loads dropped DLL 2 IoCs
pid Process 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" F4D55F6500014973000CAE15B4EB2331.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000CAE15B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" F4D55F6500014973000CAE15B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 27b767470ffaa473d2f8fab45697384791ace44d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" F4D55F6500014973000CAE15B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" F4D55F6500014973000CAE15B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 27b767470ffaa473d2f8fab45697384791ace44d.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc 27b767470ffaa473d2f8fab45697384791ace44d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" F4D55F6500014973000CAE15B4EB2331.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Security Center\svc F4D55F6500014973000CAE15B4EB2331.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 27b767470ffaa473d2f8fab45697384791ace44d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 27b767470ffaa473d2f8fab45697384791ace44d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\svc 27b767470ffaa473d2f8fab45697384791ace44d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 27b767470ffaa473d2f8fab45697384791ace44d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\F4D55F6500014973000CAE15B4EB2331 = "C:\\ProgramData\\F4D55F6500014973000CAE15B4EB2331\\F4D55F6500014973000CAE15B4EB2331.exe" F4D55F6500014973000CAE15B4EB2331.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1664 F4D55F6500014973000CAE15B4EB2331.exe 1664 F4D55F6500014973000CAE15B4EB2331.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1696 wrote to memory of 1664 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 28 PID 1696 wrote to memory of 1664 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 28 PID 1696 wrote to memory of 1664 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 28 PID 1696 wrote to memory of 1664 1696 27b767470ffaa473d2f8fab45697384791ace44d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\27b767470ffaa473d2f8fab45697384791ace44d.exe"C:\Users\Admin\AppData\Local\Temp\27b767470ffaa473d2f8fab45697384791ace44d.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\ProgramData\F4D55F6500014973000CAE15B4EB2331\F4D55F6500014973000CAE15B4EB2331.exe"C:\ProgramData\F4D55F6500014973000CAE15B4EB2331\F4D55F6500014973000CAE15B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\27b767470ffaa473d2f8fab45697384791ace44d.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1664
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD5e8f25321c19a0d7e317627b959b3cd7a
SHA127b767470ffaa473d2f8fab45697384791ace44d
SHA256825f8edaf1db522250a0c8996536c1bb015b0b47a296ea2458f166a7d5b79c03
SHA512de0101f416fbc4086947f8b33ae8b56e1b398b4dafccbbb58ffe8a82b76707bccb66c0c6141a4dc547b9c703a27f9365b2aec09cd25aeae690a90867faf2ca99
-
Filesize
432KB
MD5e8f25321c19a0d7e317627b959b3cd7a
SHA127b767470ffaa473d2f8fab45697384791ace44d
SHA256825f8edaf1db522250a0c8996536c1bb015b0b47a296ea2458f166a7d5b79c03
SHA512de0101f416fbc4086947f8b33ae8b56e1b398b4dafccbbb58ffe8a82b76707bccb66c0c6141a4dc547b9c703a27f9365b2aec09cd25aeae690a90867faf2ca99
-
Filesize
432KB
MD5e8f25321c19a0d7e317627b959b3cd7a
SHA127b767470ffaa473d2f8fab45697384791ace44d
SHA256825f8edaf1db522250a0c8996536c1bb015b0b47a296ea2458f166a7d5b79c03
SHA512de0101f416fbc4086947f8b33ae8b56e1b398b4dafccbbb58ffe8a82b76707bccb66c0c6141a4dc547b9c703a27f9365b2aec09cd25aeae690a90867faf2ca99
-
Filesize
432KB
MD5e8f25321c19a0d7e317627b959b3cd7a
SHA127b767470ffaa473d2f8fab45697384791ace44d
SHA256825f8edaf1db522250a0c8996536c1bb015b0b47a296ea2458f166a7d5b79c03
SHA512de0101f416fbc4086947f8b33ae8b56e1b398b4dafccbbb58ffe8a82b76707bccb66c0c6141a4dc547b9c703a27f9365b2aec09cd25aeae690a90867faf2ca99