Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/02/2023, 18:53
Static task
static1
Behavioral task
behavioral1
Sample
7840c07d4d8f75dcd747d96912d2518659c0cd56.exe
Resource
win7-20220812-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7840c07d4d8f75dcd747d96912d2518659c0cd56.exe
Resource
win10v2004-20221111-en
1 signatures
150 seconds
General
-
Target
7840c07d4d8f75dcd747d96912d2518659c0cd56.exe
-
Size
476KB
-
MD5
8a80deda6089d4ec669248c5ac2e8cca
-
SHA1
7840c07d4d8f75dcd747d96912d2518659c0cd56
-
SHA256
472e60a2c0f1f41c0e2adf4a849376a09050a035d0f8cb2ca8b0f341daefc4a1
-
SHA512
e64f3c994282553275bae5c9477eb70ed346bc687ed958dbc64971424b745470c654e6c962b8702e08b86b6385c98469cdbfbd3ea253203b8070802d260568d9
-
SSDEEP
12288:JCQ5gnHbL8z2hb/ha9SctISaeumhiF0AQ8Zazas:V5gm2bhqh8Q8ZaGs
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\wgy.exe," reg.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 896 PING.EXE 1152 PING.EXE 808 PING.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 580 wrote to memory of 1424 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe 28 PID 580 wrote to memory of 1424 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe 28 PID 580 wrote to memory of 1424 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe 28 PID 580 wrote to memory of 1424 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe 28 PID 1424 wrote to memory of 896 1424 cmd.exe 30 PID 1424 wrote to memory of 896 1424 cmd.exe 30 PID 1424 wrote to memory of 896 1424 cmd.exe 30 PID 1424 wrote to memory of 896 1424 cmd.exe 30 PID 580 wrote to memory of 1900 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe 31 PID 580 wrote to memory of 1900 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe 31 PID 580 wrote to memory of 1900 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe 31 PID 580 wrote to memory of 1900 580 7840c07d4d8f75dcd747d96912d2518659c0cd56.exe 31 PID 1900 wrote to memory of 1152 1900 cmd.exe 33 PID 1900 wrote to memory of 1152 1900 cmd.exe 33 PID 1900 wrote to memory of 1152 1900 cmd.exe 33 PID 1900 wrote to memory of 1152 1900 cmd.exe 33 PID 1424 wrote to memory of 1832 1424 cmd.exe 34 PID 1424 wrote to memory of 1832 1424 cmd.exe 34 PID 1424 wrote to memory of 1832 1424 cmd.exe 34 PID 1424 wrote to memory of 1832 1424 cmd.exe 34 PID 1900 wrote to memory of 808 1900 cmd.exe 35 PID 1900 wrote to memory of 808 1900 cmd.exe 35 PID 1900 wrote to memory of 808 1900 cmd.exe 35 PID 1900 wrote to memory of 808 1900 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\7840c07d4d8f75dcd747d96912d2518659c0cd56.exe"C:\Users\Admin\AppData\Local\Temp\7840c07d4d8f75dcd747d96912d2518659c0cd56.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 36 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\wgy.exe,"2⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 363⤵
- Runs ping.exe
PID:896
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\wgy.exe,"3⤵
- Modifies WinLogon for persistence
PID:1832
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 39 > nul && copy "C:\Users\Admin\AppData\Local\Temp\7840c07d4d8f75dcd747d96912d2518659c0cd56.exe" "C:\Users\Admin\AppData\Local\wgy.exe" && ping 127.0.0.1 -n 39 > nul && "C:\Users\Admin\AppData\Local\wgy.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 393⤵
- Runs ping.exe
PID:1152
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 393⤵
- Runs ping.exe
PID:808
-
-