Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
199s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/01/2023, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe
Resource
win7-20221111-en
General
-
Target
916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe
-
Size
4.1MB
-
MD5
3eaf114e7d481c57147ed8b8ba3c4caa
-
SHA1
62ce40d8a9c47527e88dab1e3e60e8495cad6029
-
SHA256
916d53e09da4c910f04585026f5aab7410c391e30c0d560159ad16e936272eeb
-
SHA512
0112492901fccec1f5045860b5a1093c38cd859ee3f531ae7aed7ce3c01ea2d9df05420cb93293876b68c5f9ab91b293316df0a068f059c0ba27d6d93de2b2fc
-
SSDEEP
98304:6gCJYcoRB/Om0t7MZwAvPcVx0qa96SQ7p1YGt4Q24DEBziWz:6gCScaB/Om0tkw2EEqh1YVV4QV
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1504 osmserv.exe 1496 osmserv.exe 840 osmserv.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation osmserv.exe Key value queried \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation osmserv.exe -
Loads dropped DLL 11 IoCs
pid Process 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 1504 osmserv.exe 1504 osmserv.exe 1496 osmserv.exe 1496 osmserv.exe 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 840 osmserv.exe 840 osmserv.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\OSM\osmserv.exe 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe File created C:\Program Files\OSM\ssleay32.dll 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe File created C:\Program Files\OSM\libeay32.dll 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1340 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 1504 osmserv.exe 1504 osmserv.exe 1504 osmserv.exe 1504 osmserv.exe 1504 osmserv.exe 1504 osmserv.exe 1496 osmserv.exe 1496 osmserv.exe 1496 osmserv.exe 1496 osmserv.exe 1496 osmserv.exe 1496 osmserv.exe 840 osmserv.exe 840 osmserv.exe 840 osmserv.exe 840 osmserv.exe 840 osmserv.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1504 osmserv.exe Token: SeTakeOwnershipPrivilege 1496 osmserv.exe Token: SeTcbPrivilege 1496 osmserv.exe Token: SeTcbPrivilege 1496 osmserv.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1504 osmserv.exe 1504 osmserv.exe 1504 osmserv.exe 1504 osmserv.exe 1496 osmserv.exe 1496 osmserv.exe 1496 osmserv.exe 1496 osmserv.exe 840 osmserv.exe 840 osmserv.exe 840 osmserv.exe 840 osmserv.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1776 wrote to memory of 1504 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 27 PID 1776 wrote to memory of 1504 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 27 PID 1776 wrote to memory of 1504 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 27 PID 1776 wrote to memory of 1504 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 27 PID 1776 wrote to memory of 828 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 29 PID 1776 wrote to memory of 828 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 29 PID 1776 wrote to memory of 828 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 29 PID 1776 wrote to memory of 828 1776 916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe 29 PID 828 wrote to memory of 1340 828 cmd.exe 31 PID 828 wrote to memory of 1340 828 cmd.exe 31 PID 828 wrote to memory of 1340 828 cmd.exe 31 PID 828 wrote to memory of 1340 828 cmd.exe 31 PID 828 wrote to memory of 1356 828 cmd.exe 32 PID 828 wrote to memory of 1356 828 cmd.exe 32 PID 828 wrote to memory of 1356 828 cmd.exe 32 PID 828 wrote to memory of 1356 828 cmd.exe 32 PID 828 wrote to memory of 1112 828 cmd.exe 33 PID 828 wrote to memory of 1112 828 cmd.exe 33 PID 828 wrote to memory of 1112 828 cmd.exe 33 PID 828 wrote to memory of 1112 828 cmd.exe 33 PID 1808 wrote to memory of 840 1808 taskeng.exe 35 PID 1808 wrote to memory of 840 1808 taskeng.exe 35 PID 1808 wrote to memory of 840 1808 taskeng.exe 35 PID 1808 wrote to memory of 840 1808 taskeng.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe"C:\Users\Admin\AppData\Local\Temp\916D53E09DA4C910F04585026F5AAB7410C391E30C0D5.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files\OSM\osmserv.exe"C:\Program Files\OSM\osmserv.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Program Files\OSM\osmserv.exe"C:\Program Files\OSM\osmserv.exe" -second3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1496
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SchTasks /create /f /XML %temp%\Log360.xml /TN \microsoft\windows\defrag\scheduleddefrag && schtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE && schtasks /run /TN \microsoft\windows\defrag\scheduleddefrag2⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\schtasks.exeSchTasks /create /f /XML C:\Users\Admin\AppData\Local\Temp\Log360.xml /TN \microsoft\windows\defrag\scheduleddefrag3⤵
- Creates scheduled task(s)
PID:1340
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN \microsoft\windows\defrag\scheduleddefrag /ENABLE3⤵PID:1356
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /TN \microsoft\windows\defrag\scheduleddefrag3⤵PID:1112
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {C4A35032-FE20-4ADA-94CC-A32D0E1E2F8A} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Program Files\OSM\osmserv.exe"C:\Program Files\OSM\osmserv.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:840
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
11.2MB
MD5472741c5c56e6bc0abda9e34615f3e6d
SHA193f34ab3e7787ac577837904c3a4eb6374c25aaa
SHA25687846d788c3a189eed07822136e23d63413c4da216a08e1ea0e1cfadb54093fd
SHA512437bf378acc09141c2f41f63d5b3afd2b17e4f51b88d8ff5a5c306cc85ad0dcb57dc5c8474b64f40b070530aac93b94fa46c0d0b8550d1027e8459d76b05d89e
-
Filesize
11.2MB
MD5472741c5c56e6bc0abda9e34615f3e6d
SHA193f34ab3e7787ac577837904c3a4eb6374c25aaa
SHA25687846d788c3a189eed07822136e23d63413c4da216a08e1ea0e1cfadb54093fd
SHA512437bf378acc09141c2f41f63d5b3afd2b17e4f51b88d8ff5a5c306cc85ad0dcb57dc5c8474b64f40b070530aac93b94fa46c0d0b8550d1027e8459d76b05d89e
-
Filesize
11.2MB
MD5472741c5c56e6bc0abda9e34615f3e6d
SHA193f34ab3e7787ac577837904c3a4eb6374c25aaa
SHA25687846d788c3a189eed07822136e23d63413c4da216a08e1ea0e1cfadb54093fd
SHA512437bf378acc09141c2f41f63d5b3afd2b17e4f51b88d8ff5a5c306cc85ad0dcb57dc5c8474b64f40b070530aac93b94fa46c0d0b8550d1027e8459d76b05d89e
-
Filesize
11.2MB
MD5472741c5c56e6bc0abda9e34615f3e6d
SHA193f34ab3e7787ac577837904c3a4eb6374c25aaa
SHA25687846d788c3a189eed07822136e23d63413c4da216a08e1ea0e1cfadb54093fd
SHA512437bf378acc09141c2f41f63d5b3afd2b17e4f51b88d8ff5a5c306cc85ad0dcb57dc5c8474b64f40b070530aac93b94fa46c0d0b8550d1027e8459d76b05d89e
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
1KB
MD519bee630b0262c8cfaa3352c6bc3cbc7
SHA1cbf015af4909c920af7268430e757015cb5d1d26
SHA2561235422a8be537021b5688cd129b60fc145f33af7c46e35ba2b59e77cd48352d
SHA51265e7db3dffa067641149e2556a140eabc14edeb13ae132754f292d1a3f484df45facbf16722cefd9cc958a1f7026a310b41755552a10438984a61a6772fb3d1f
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
1.3MB
MD54cb2e1b9294ddae1bf7dcaaf42b365d1
SHA1a225f53a8403d9b73d77bcbb075194520cce5a14
SHA256a8124500cae0aba3411428c2c6df2762ea11cc11c312abed415d3f3667eb6884
SHA51246cf4abf9121c865c725ca159df71066e0662595915d653914e4ec047f94e2ab3823f85c9e0e0c1311304c460c90224bd3141da62091c733dcaa5dccf64c04bb
-
Filesize
11.2MB
MD5472741c5c56e6bc0abda9e34615f3e6d
SHA193f34ab3e7787ac577837904c3a4eb6374c25aaa
SHA25687846d788c3a189eed07822136e23d63413c4da216a08e1ea0e1cfadb54093fd
SHA512437bf378acc09141c2f41f63d5b3afd2b17e4f51b88d8ff5a5c306cc85ad0dcb57dc5c8474b64f40b070530aac93b94fa46c0d0b8550d1027e8459d76b05d89e
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
337KB
MD55c268ca919854fc22d85f916d102ee7f
SHA10957cf86e0334673eb45945985b5c033b412be0e
SHA2561f4b3efc919af1106f348662ee9ad95ab019058ff502e3d68e1b5f7abff91b56
SHA51276d0abad1d7d0856ec1b8e598b05a2a6eece220ea39d74e7f6278a4219e22c75b7f618160ce41810daa57d5d4d534afd78f5cc1bd6de927dbb6a551aca2f8310
-
Filesize
105KB
MD54b0617493f32b2b5fe5e838eeb885819
SHA1336e84380420a9caaa9c12af7c8e530135e63c57
SHA256df3621f83e9d11be45e0e617b899c4ab0241f60ed56494e892dc449482058402
SHA5125c50cf97cd9a6c699ec7928a08f77f4eaa68105e87a974432e39b637f926f0df8a95ec19bd63465fc438a4ef6349398938bc8d7651de125d13ccab89d1d49143
-
Filesize
12KB
MD58cf2ac271d7679b1d68eefc1ae0c5618
SHA17cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA2566950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
-
Filesize
7KB
MD5f27689c513e7d12c7c974d5f8ef710d6
SHA1e305f2a2898d765a64c82c449dfb528665b4a892
SHA2561f18f4126124b0551f3dbcd0fec7f34026f930ca509f04435657cedc32ae8c47
SHA512734e9f3989ee47a86bee16838df7a09353c7fe085a09d77e70d281b21c5477b0b061616e72e8ac8fcb3dda1df0d5152f54dcc4c5a77f90fbf0f857557bf02fbc
-
Filesize
24KB
MD52b7007ed0262ca02ef69d8990815cbeb
SHA12eabe4f755213666dbbbde024a5235ddde02b47f
SHA2560b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca