Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
15/03/2023, 05:22
Static task
static1
Behavioral task
behavioral1
Sample
fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe
Resource
win7-20230220-en
General
-
Target
fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe
-
Size
3.4MB
-
MD5
c15dcae56336f681ea1dd5aad33bb62b
-
SHA1
dec7bdfc4c06c2f1475e9159916da6fd05c7fc36
-
SHA256
fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c
-
SHA512
4e799450778e10b009e9e81771537b24d05a52cc6799ec869e46327f07b0d68acd478156c4370947aac11e55f69483f422c3f5a00baa878588001fe10c8e2e7b
-
SSDEEP
49152:onrbOKMFrJmsf6/HAv4fVCnoYcNmCCyQaxfrLkWUhsZz2RNRenjqc4i3PHkVgXIf:YaEU6/HWQ4noYOCtapQX9ejqcT3/SgYf
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe -
Executes dropped EXE 2 IoCs
pid Process 1768 Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe 1920 Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe -
Loads dropped DLL 4 IoCs
pid Process 1984 AppLaunch.exe 1984 AppLaunch.exe 664 taskeng.exe 664 taskeng.exe -
Modifies file permissions 1 TTPs 3 IoCs
pid Process 1008 icacls.exe 360 icacls.exe 1680 icacls.exe -
resource yara_rule behavioral1/files/0x0009000000012305-70.dat upx behavioral1/files/0x0009000000012305-71.dat upx behavioral1/files/0x0009000000012305-74.dat upx behavioral1/files/0x0009000000012305-75.dat upx behavioral1/memory/1768-78-0x000000013FED0000-0x00000001403EF000-memory.dmp upx behavioral1/files/0x0009000000012305-79.dat upx behavioral1/memory/1768-80-0x000000013FED0000-0x00000001403EF000-memory.dmp upx behavioral1/memory/1768-81-0x000000013FED0000-0x00000001403EF000-memory.dmp upx behavioral1/memory/1768-82-0x000000013FED0000-0x00000001403EF000-memory.dmp upx behavioral1/files/0x0009000000012305-83.dat upx behavioral1/files/0x0009000000012305-85.dat upx behavioral1/files/0x0009000000012305-84.dat upx behavioral1/memory/1768-88-0x000000013FED0000-0x00000001403EF000-memory.dmp upx behavioral1/memory/1920-89-0x000000013FED0000-0x00000001403EF000-memory.dmp upx behavioral1/memory/1920-90-0x000000013FED0000-0x00000001403EF000-memory.dmp upx behavioral1/memory/1920-91-0x000000013FED0000-0x00000001403EF000-memory.dmp upx behavioral1/memory/1920-92-0x000000013FED0000-0x00000001403EF000-memory.dmp upx -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1976 set thread context of 1984 1976 fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe 28 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1372 schtasks.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1984 1976 fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe 28 PID 1976 wrote to memory of 1984 1976 fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe 28 PID 1976 wrote to memory of 1984 1976 fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe 28 PID 1976 wrote to memory of 1984 1976 fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe 28 PID 1976 wrote to memory of 1984 1976 fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe 28 PID 1976 wrote to memory of 1984 1976 fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe 28 PID 1976 wrote to memory of 1984 1976 fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe 28 PID 1976 wrote to memory of 1984 1976 fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe 28 PID 1976 wrote to memory of 1984 1976 fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe 28 PID 1984 wrote to memory of 1008 1984 AppLaunch.exe 29 PID 1984 wrote to memory of 1008 1984 AppLaunch.exe 29 PID 1984 wrote to memory of 1008 1984 AppLaunch.exe 29 PID 1984 wrote to memory of 1008 1984 AppLaunch.exe 29 PID 1984 wrote to memory of 1008 1984 AppLaunch.exe 29 PID 1984 wrote to memory of 1008 1984 AppLaunch.exe 29 PID 1984 wrote to memory of 1008 1984 AppLaunch.exe 29 PID 1984 wrote to memory of 360 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 360 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 360 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 360 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 360 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 360 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 360 1984 AppLaunch.exe 30 PID 1984 wrote to memory of 1680 1984 AppLaunch.exe 33 PID 1984 wrote to memory of 1680 1984 AppLaunch.exe 33 PID 1984 wrote to memory of 1680 1984 AppLaunch.exe 33 PID 1984 wrote to memory of 1680 1984 AppLaunch.exe 33 PID 1984 wrote to memory of 1680 1984 AppLaunch.exe 33 PID 1984 wrote to memory of 1680 1984 AppLaunch.exe 33 PID 1984 wrote to memory of 1680 1984 AppLaunch.exe 33 PID 1984 wrote to memory of 1372 1984 AppLaunch.exe 35 PID 1984 wrote to memory of 1372 1984 AppLaunch.exe 35 PID 1984 wrote to memory of 1372 1984 AppLaunch.exe 35 PID 1984 wrote to memory of 1372 1984 AppLaunch.exe 35 PID 1984 wrote to memory of 1372 1984 AppLaunch.exe 35 PID 1984 wrote to memory of 1372 1984 AppLaunch.exe 35 PID 1984 wrote to memory of 1372 1984 AppLaunch.exe 35 PID 1984 wrote to memory of 1768 1984 AppLaunch.exe 37 PID 1984 wrote to memory of 1768 1984 AppLaunch.exe 37 PID 1984 wrote to memory of 1768 1984 AppLaunch.exe 37 PID 1984 wrote to memory of 1768 1984 AppLaunch.exe 37 PID 664 wrote to memory of 1920 664 taskeng.exe 39 PID 664 wrote to memory of 1920 664 taskeng.exe 39 PID 664 wrote to memory of 1920 664 taskeng.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe"C:\Users\Admin\AppData\Local\Temp\fc79578491fc873a67d446cc6f7cc4df92c589516e2c7bc7b2d418823838d97c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"3⤵
- Modifies file permissions
PID:1008
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"3⤵
- Modifies file permissions
PID:360
-
-
C:\Windows\SysWOW64\icacls.exe"C:\Windows\System32\icacls.exe" "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5" /inheritance:e /deny "admin:(R,REA,RA,RD)"3⤵
- Modifies file permissions
PID:1680
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5" /TR "C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe" /SC MINUTE3⤵
- Creates scheduled task(s)
PID:1372
-
-
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe"C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1768
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {7A6919CB-F91A-412E-AFC3-7DF02BFA5C3D} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:664 -
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exeC:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1920
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe
Filesize401.0MB
MD5013d67893212171480ee0d0eb56e41a2
SHA1b9ead447f8a2089dbf850eaf929006c80275bb59
SHA256da6a6bb94e9bd2e48c199ef8fe0eeaab1e36baf88d266d75fee79ff810abff8c
SHA5128c232108e90b08a1e1613f74c0223f1dd5cb459816acfa233ea88f3cc153d073db73966fb4b001625ea0d3e78a0116070485bbe95ef1bccf6ecc392708692cc8
-
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe
Filesize393.6MB
MD5529784f9ad14b9710c379b2305547e91
SHA1436d1244c51b25f5da5d1d0115c3aabe1f6dded6
SHA25629cd18ad9b556b14685b197b67bc39f031ec243bba721948dce4be7a7cfba503
SHA512e84aefb8b0f68a25749e1af3c5dc536e36da56c95d642cddbe1594cabd7b60536347c7de635bece671b201cabdd998924d8894a717ab4a6bf9a0ef2cfadde19a
-
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe
Filesize393.4MB
MD5a51f7fba883b2dcd73255633644a95c6
SHA12fc70ce99a336eec8d304f47dd536dce047da894
SHA2562a523bf1a396d1236d82783cf20d620db70c4edd9764f753faca35921f8e7cd1
SHA51295f9942e3d0874ce74ccd4c239e8f92bc5260673d7a8b1c698961605ca910faa8d6c331c05f03daab4fa1472713ff15be5f0f29adcfc0703b45ea09675cb0761
-
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe
Filesize373.9MB
MD5c5779b334346c1337b06433fe11f78fb
SHA140f22caa8903709c2d253acb9911a1bf3599925c
SHA256db2e35527c6028a7190046312d5f423e405e2eddc29e9d519e780106e86b9976
SHA512cc25ae1c89dd71afddc6c31b2317a38b69df89a6f25e7fa4e93f1c8a431ac4c1b43997884cfb551035f68122ad2c037cb3db4b5ac0f2de5b883db73e79a3d077
-
\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe
Filesize397.1MB
MD5e99292e555c22e43cbdaab0d338f4e9e
SHA1bded8fb3aa460216ad816d4f945d74b67a945b23
SHA25633b3ffda85cfb00723e5491f882a203c143a438f5e30d6942fd8068895354a24
SHA5127731054b8e39061185734512590b93ffed08b0e5b71152010aca45ee78f4d8efd3ee68fe00e747761730fa1695b1d5f44ef288b9fbccedea8daea64f201d5006
-
\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe
Filesize398.5MB
MD5f9100b7a5b007e986c330af94c7f4357
SHA1b42dc015c4686633f07293d174c12305484772c5
SHA256b83913229ae7e3caddfc07019b37c049d9e9f2b99a54e14aa5f137daa5fe69b8
SHA512d8c1c0e02b167f950fe39722929fd0d120bed6bab33b761ed6cac9864c771d5a6e873b36606fe60d1d0687a8c10310d43a698e48ce4a73d88119221c44c20bb1
-
\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe
Filesize371.9MB
MD5bdcda7c2e3f3b8bbf7e1262008f98614
SHA16caea51327f57ac17b3f5fab2fe749eee141ffe0
SHA2561e80248fef6ed8fc5da9463c08723645c8e9488c346c6999053b963eba5c99ab
SHA51205e255be586073b95bd02ea44fcf1b3f2dbeb1a0532429d39c145baefba381e6df042096c22e7fd7bfa3e7179c4c6bb57bfc9a0326db3c40324dbaef07b55cab
-
\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38Favorites-type2.1.0.5.exe
Filesize378.6MB
MD5aea814292d14ff50ae6a67089d9c143a
SHA143f2b980c557dfc1d26516e2914fc560cf43d3cc
SHA2567f1afffdb1410ab85aa383bdfeb51789d775a2cb79fa659af40ca3868ff3c13e
SHA5129832527d2d07f8ad67e8876fa8c163e60f219dae42d00e9652afef35c57eeac0d00de862cf22bb08c31f419bd07f32b511b0242c9755e7b04eb572332cfdc56a