Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/02/2023, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER RFQ_CF-170419S3_.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PURCHASE ORDER RFQ_CF-170419S3_.exe
Resource
win10v2004-20221111-en
General
-
Target
PURCHASE ORDER RFQ_CF-170419S3_.exe
-
Size
1.1MB
-
MD5
10e0c2c544c56f8bb1deb536590606ff
-
SHA1
99a8d3a2bc97c8941d0c78bb655e2d57244706f4
-
SHA256
77b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
-
SHA512
3fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
SSDEEP
24576:LCMmK3Aw7NM0AiSYLaTm4W0hZEd3/2dhJgM9bObUtv:LC+7q0tqT5No6wMl8Ut
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 1768 VQwinup.exe 964 VQwinup.exe 972 VQwinup.exe 1576 VQwinup.exe 2012 VQwinup.exe -
Loads dropped DLL 6 IoCs
pid Process 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 1768 VQwinup.exe 964 VQwinup.exe 972 VQwinup.exe 1576 VQwinup.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PURCHASE ORDER RFQ_CF-170419S3_.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\TYboDhwl\\VQHHtUoO.exe" PURCHASE ORDER RFQ_CF-170419S3_.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2016 set thread context of 892 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 27 PID 1768 set thread context of 2044 1768 VQwinup.exe 29 PID 964 set thread context of 1924 964 VQwinup.exe 31 PID 972 set thread context of 1384 972 VQwinup.exe 33 PID 1576 set thread context of 1732 1576 VQwinup.exe 35 PID 2012 set thread context of 388 2012 VQwinup.exe 37 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 1768 VQwinup.exe 964 VQwinup.exe 972 VQwinup.exe 1576 VQwinup.exe 2012 VQwinup.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 892 regasm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 892 regasm.exe Token: 33 892 regasm.exe Token: SeIncBasePriorityPrivilege 892 regasm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 892 regasm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 892 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 27 PID 2016 wrote to memory of 892 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 27 PID 2016 wrote to memory of 892 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 27 PID 2016 wrote to memory of 892 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 27 PID 2016 wrote to memory of 892 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 27 PID 2016 wrote to memory of 892 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 27 PID 2016 wrote to memory of 892 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 27 PID 2016 wrote to memory of 892 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 27 PID 2016 wrote to memory of 892 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 27 PID 2016 wrote to memory of 1768 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2016 wrote to memory of 1768 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2016 wrote to memory of 1768 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 2016 wrote to memory of 1768 2016 PURCHASE ORDER RFQ_CF-170419S3_.exe 28 PID 1768 wrote to memory of 2044 1768 VQwinup.exe 29 PID 1768 wrote to memory of 2044 1768 VQwinup.exe 29 PID 1768 wrote to memory of 2044 1768 VQwinup.exe 29 PID 1768 wrote to memory of 2044 1768 VQwinup.exe 29 PID 1768 wrote to memory of 2044 1768 VQwinup.exe 29 PID 1768 wrote to memory of 2044 1768 VQwinup.exe 29 PID 1768 wrote to memory of 2044 1768 VQwinup.exe 29 PID 1768 wrote to memory of 2044 1768 VQwinup.exe 29 PID 1768 wrote to memory of 2044 1768 VQwinup.exe 29 PID 1768 wrote to memory of 964 1768 VQwinup.exe 30 PID 1768 wrote to memory of 964 1768 VQwinup.exe 30 PID 1768 wrote to memory of 964 1768 VQwinup.exe 30 PID 1768 wrote to memory of 964 1768 VQwinup.exe 30 PID 964 wrote to memory of 1924 964 VQwinup.exe 31 PID 964 wrote to memory of 1924 964 VQwinup.exe 31 PID 964 wrote to memory of 1924 964 VQwinup.exe 31 PID 964 wrote to memory of 1924 964 VQwinup.exe 31 PID 964 wrote to memory of 1924 964 VQwinup.exe 31 PID 964 wrote to memory of 1924 964 VQwinup.exe 31 PID 964 wrote to memory of 1924 964 VQwinup.exe 31 PID 964 wrote to memory of 1924 964 VQwinup.exe 31 PID 964 wrote to memory of 1924 964 VQwinup.exe 31 PID 964 wrote to memory of 972 964 VQwinup.exe 32 PID 964 wrote to memory of 972 964 VQwinup.exe 32 PID 964 wrote to memory of 972 964 VQwinup.exe 32 PID 964 wrote to memory of 972 964 VQwinup.exe 32 PID 972 wrote to memory of 1384 972 VQwinup.exe 33 PID 972 wrote to memory of 1384 972 VQwinup.exe 33 PID 972 wrote to memory of 1384 972 VQwinup.exe 33 PID 972 wrote to memory of 1384 972 VQwinup.exe 33 PID 972 wrote to memory of 1384 972 VQwinup.exe 33 PID 972 wrote to memory of 1384 972 VQwinup.exe 33 PID 972 wrote to memory of 1384 972 VQwinup.exe 33 PID 972 wrote to memory of 1384 972 VQwinup.exe 33 PID 972 wrote to memory of 1384 972 VQwinup.exe 33 PID 972 wrote to memory of 1576 972 VQwinup.exe 34 PID 972 wrote to memory of 1576 972 VQwinup.exe 34 PID 972 wrote to memory of 1576 972 VQwinup.exe 34 PID 972 wrote to memory of 1576 972 VQwinup.exe 34 PID 1576 wrote to memory of 1732 1576 VQwinup.exe 35 PID 1576 wrote to memory of 1732 1576 VQwinup.exe 35 PID 1576 wrote to memory of 1732 1576 VQwinup.exe 35 PID 1576 wrote to memory of 1732 1576 VQwinup.exe 35 PID 1576 wrote to memory of 1732 1576 VQwinup.exe 35 PID 1576 wrote to memory of 1732 1576 VQwinup.exe 35 PID 1576 wrote to memory of 1732 1576 VQwinup.exe 35 PID 1576 wrote to memory of 1732 1576 VQwinup.exe 35 PID 1576 wrote to memory of 1732 1576 VQwinup.exe 35 PID 1576 wrote to memory of 2012 1576 VQwinup.exe 36 PID 1576 wrote to memory of 2012 1576 VQwinup.exe 36 PID 1576 wrote to memory of 2012 1576 VQwinup.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER RFQ_CF-170419S3_.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER RFQ_CF-170419S3_.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:892
-
-
C:\Users\Admin\AppData\Local\Temp\VQwinup.exeC:\Users\Admin\AppData\Local\Temp\VQwinup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"3⤵PID:2044
-
-
C:\Users\Admin\AppData\Local\Temp\VQwinup.exeC:\Users\Admin\AppData\Local\Temp\VQwinup.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"4⤵PID:1924
-
-
C:\Users\Admin\AppData\Local\Temp\VQwinup.exeC:\Users\Admin\AppData\Local\Temp\VQwinup.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"5⤵PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\VQwinup.exeC:\Users\Admin\AppData\Local\Temp\VQwinup.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"6⤵PID:1732
-
-
C:\Users\Admin\AppData\Local\Temp\VQwinup.exeC:\Users\Admin\AppData\Local\Temp\VQwinup.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2012 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe"7⤵PID:388
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea
-
Filesize
1.1MB
MD510e0c2c544c56f8bb1deb536590606ff
SHA199a8d3a2bc97c8941d0c78bb655e2d57244706f4
SHA25677b7607e09f39f64d606008da2c8009faf892f625843e3db0dff4ac304edba8d
SHA5123fed3afdc39e4635bc9fb6a2525e4850c00d882b15dc8fd218c64d4df1ad4e358564cf3e13f7909aa96c0afcca1c3e48245b83e91b83fa69dd578c98b409f1ea