Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/02/2023, 09:21
Static task
static1
Behavioral task
behavioral1
Sample
winserv.exe
Resource
win7-20221111-en
5 signatures
150 seconds
General
-
Target
winserv.exe
-
Size
10.2MB
-
MD5
3f4f5a6cb95047fea6102bd7d2226aa9
-
SHA1
fc09dd898b6e7ff546e4a7517a715928fbafc297
-
SHA256
99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
-
SHA512
de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688
-
SSDEEP
196608:iz+UZcWP4jBrfWgEgIV8Rzy7Vj4FZvEo:i6UZcWWeVj4FZ
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 5096 created 4752 5096 svchost.exe 79 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation winserv.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 5072 winserv.exe 5072 winserv.exe 5072 winserv.exe 5072 winserv.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4752 winserv.exe Token: SeTcbPrivilege 5096 svchost.exe Token: SeTcbPrivilege 5096 svchost.exe Token: SeTakeOwnershipPrivilege 5072 winserv.exe Token: SeTcbPrivilege 5072 winserv.exe Token: SeTcbPrivilege 5072 winserv.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 5072 winserv.exe 5072 winserv.exe 5072 winserv.exe 5072 winserv.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5096 wrote to memory of 5072 5096 svchost.exe 81 PID 5096 wrote to memory of 5072 5096 svchost.exe 81 PID 5096 wrote to memory of 5072 5096 svchost.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\winserv.exe"C:\Users\Admin\AppData\Local\Temp\winserv.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\winserv.exeC:\Users\Admin\AppData\Local\Temp\winserv.exe -second2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5072
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096