Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/02/2023, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER RFQ_CF-170419S3_.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
PURCHASE ORDER RFQ_CF-170419S3_.exe
Resource
win10v2004-20220812-en
General
-
Target
PURCHASE ORDER RFQ_CF-170419S3_.exe
-
Size
1.1MB
-
MD5
10e0c2c544c56f8bb1deb536590606ff
-
SHA1
99a8d3a2bc97c8941d0c78bb655e2d57244706f4
-
SHA256
77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
-
SHA512
3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
SSDEEP
24576:LCMmK3Aw7NM0AiSYLaTm4W0hZEd3/2dhJgM9bObUtv:LC+7q0tqT5No6wMl8Ut
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 1120 VQwinup.exe 840 VQwinup.exe 1036 VQwinup.exe 636 VQwinup.exe 1128 VQwinup.exe 760 VQwinup.exe -
Loads dropped DLL 7 IoCs
pid Process 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 1120 VQwinup.exe 840 VQwinup.exe 1036 VQwinup.exe 636 VQwinup.exe 1128 VQwinup.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PURCHASE ORDER RFQ_CF-170419S3_.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\TYboDhwl\\VQHHtUoO.exe" PURCHASE ORDER RFQ_CF-170419S3_.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2024 set thread context of 1736 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 1120 set thread context of 276 1120 VQwinup.exe 30 PID 840 set thread context of 1600 840 VQwinup.exe 32 PID 1036 set thread context of 1244 1036 VQwinup.exe 34 PID 636 set thread context of 288 636 VQwinup.exe 36 PID 1128 set thread context of 896 1128 VQwinup.exe 38 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 1120 VQwinup.exe 840 VQwinup.exe 1036 VQwinup.exe 636 VQwinup.exe 1128 VQwinup.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1736 regasm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1736 regasm.exe Token: 33 1736 regasm.exe Token: SeIncBasePriorityPrivilege 1736 regasm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1736 regasm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1736 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2024 wrote to memory of 1736 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2024 wrote to memory of 1736 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2024 wrote to memory of 1736 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2024 wrote to memory of 1736 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2024 wrote to memory of 1736 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2024 wrote to memory of 1736 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2024 wrote to memory of 1736 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2024 wrote to memory of 1736 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2024 wrote to memory of 1120 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 29 PID 2024 wrote to memory of 1120 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 29 PID 2024 wrote to memory of 1120 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 29 PID 2024 wrote to memory of 1120 2024 PURCHASE ORDER RFQ_CF-170419S3_.exe 29 PID 1120 wrote to memory of 276 1120 VQwinup.exe 30 PID 1120 wrote to memory of 276 1120 VQwinup.exe 30 PID 1120 wrote to memory of 276 1120 VQwinup.exe 30 PID 1120 wrote to memory of 276 1120 VQwinup.exe 30 PID 1120 wrote to memory of 276 1120 VQwinup.exe 30 PID 1120 wrote to memory of 276 1120 VQwinup.exe 30 PID 1120 wrote to memory of 276 1120 VQwinup.exe 30 PID 1120 wrote to memory of 276 1120 VQwinup.exe 30 PID 1120 wrote to memory of 276 1120 VQwinup.exe 30 PID 1120 wrote to memory of 840 1120 VQwinup.exe 31 PID 1120 wrote to memory of 840 1120 VQwinup.exe 31 PID 1120 wrote to memory of 840 1120 VQwinup.exe 31 PID 1120 wrote to memory of 840 1120 VQwinup.exe 31 PID 840 wrote to memory of 1600 840 VQwinup.exe 32 PID 840 wrote to memory of 1600 840 VQwinup.exe 32 PID 840 wrote to memory of 1600 840 VQwinup.exe 32 PID 840 wrote to memory of 1600 840 VQwinup.exe 32 PID 840 wrote to memory of 1600 840 VQwinup.exe 32 PID 840 wrote to memory of 1600 840 VQwinup.exe 32 PID 840 wrote to memory of 1600 840 VQwinup.exe 32 PID 840 wrote to memory of 1600 840 VQwinup.exe 32 PID 840 wrote to memory of 1600 840 VQwinup.exe 32 PID 840 wrote to memory of 1036 840 VQwinup.exe 33 PID 840 wrote to memory of 1036 840 VQwinup.exe 33 PID 840 wrote to memory of 1036 840 VQwinup.exe 33 PID 840 wrote to memory of 1036 840 VQwinup.exe 33 PID 1036 wrote to memory of 1244 1036 VQwinup.exe 34 PID 1036 wrote to memory of 1244 1036 VQwinup.exe 34 PID 1036 wrote to memory of 1244 1036 VQwinup.exe 34 PID 1036 wrote to memory of 1244 1036 VQwinup.exe 34 PID 1036 wrote to memory of 1244 1036 VQwinup.exe 34 PID 1036 wrote to memory of 1244 1036 VQwinup.exe 34 PID 1036 wrote to memory of 1244 1036 VQwinup.exe 34 PID 1036 wrote to memory of 1244 1036 VQwinup.exe 34 PID 1036 wrote to memory of 1244 1036 VQwinup.exe 34 PID 1036 wrote to memory of 636 1036 VQwinup.exe 35 PID 1036 wrote to memory of 636 1036 VQwinup.exe 35 PID 1036 wrote to memory of 636 1036 VQwinup.exe 35 PID 1036 wrote to memory of 636 1036 VQwinup.exe 35 PID 636 wrote to memory of 288 636 VQwinup.exe 36 PID 636 wrote to memory of 288 636 VQwinup.exe 36 PID 636 wrote to memory of 288 636 VQwinup.exe 36 PID 636 wrote to memory of 288 636 VQwinup.exe 36 PID 636 wrote to memory of 288 636 VQwinup.exe 36 PID 636 wrote to memory of 288 636 VQwinup.exe 36 PID 636 wrote to memory of 288 636 VQwinup.exe 36 PID 636 wrote to memory of 288 636 VQwinup.exe 36 PID 636 wrote to memory of 288 636 VQwinup.exe 36 PID 636 wrote to memory of 1128 636 VQwinup.exe 37 PID 636 wrote to memory of 1128 636 VQwinup.exe 37 PID 636 wrote to memory of 1128 636 VQwinup.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER RFQ_CF-170419S3_.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER RFQ_CF-170419S3_.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
C:\Users\Admin\AppData\Local\Temp\VQwinup.exeC:\Users\Admin\AppData\Local\Temp\VQwinup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"3⤵PID:276
-
-
C:\Users\Admin\AppData\Local\Temp\VQwinup.exeC:\Users\Admin\AppData\Local\Temp\VQwinup.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"4⤵PID:1600
-
-
C:\Users\Admin\AppData\Local\Temp\VQwinup.exeC:\Users\Admin\AppData\Local\Temp\VQwinup.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"5⤵PID:1244
-
-
C:\Users\Admin\AppData\Local\Temp\VQwinup.exeC:\Users\Admin\AppData\Local\Temp\VQwinup.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"6⤵PID:288
-
-
C:\Users\Admin\AppData\Local\Temp\VQwinup.exeC:\Users\Admin\AppData\Local\Temp\VQwinup.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1128 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"7⤵PID:896
-
-
C:\Users\Admin\AppData\Local\Temp\VQwinup.exeC:\Users\Admin\AppData\Local\Temp\VQwinup.exe7⤵
- Executes dropped EXE
PID:760
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea