Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/03/2023, 14:38
Behavioral task
behavioral1
Sample
cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe
Resource
win7-20230220-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe
-
Size
3.4MB
-
MD5
1dcfb969cf87e2e4cb9bb4a56e750e15
-
SHA1
c0d398d156582131a4dca76bdb85cf6e3342d68c
-
SHA256
cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c
-
SHA512
f6b9bed8db1012566c80dec02471a6af4a052bf62361f0a51432340960b7cc5b776b384458a47aa462b3f6fa1fd507c0d05f1b5d74216402447d9dfa25771b5b
-
SSDEEP
49152:Mvcs1F4p7LFsNqzfQX6mqDHLvtf2YyAqRZEI/1Tag5rTIluaYdfPKrpjJwebZVTL:MPFUz1DHdgBd26TrPsV2gTgikq
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
resource yara_rule behavioral1/memory/2040-54-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-55-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-56-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-58-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-57-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-59-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-60-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-62-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-61-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-66-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-67-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-68-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-69-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-70-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-71-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-72-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-73-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-74-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-75-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-76-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-77-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-78-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-79-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-80-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida behavioral1/memory/2040-81-0x00000000013B0000-0x0000000001B9E000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\RYMTSF = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\Chrome.exe\"" cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
AutoIT Executable 24 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2040-55-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-56-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-58-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-57-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-59-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-60-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-62-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-61-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-66-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-67-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-68-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-69-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-70-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-71-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-72-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-73-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-74-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-75-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-76-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-77-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-78-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-79-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-80-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe behavioral1/memory/2040-81-0x00000000013B0000-0x0000000001B9E000-memory.dmp autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1328 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 28 PID 2040 wrote to memory of 1328 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 28 PID 2040 wrote to memory of 1328 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 28 PID 2040 wrote to memory of 1328 2040 cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe"C:\Users\Admin\AppData\Local\Temp\cc17a2ff14ae0f1457abbb990c2612a5503c96ddfa5916bb2a1a8dad2e16238c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\RYMTSF.vbs2⤵PID:1328
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
948B
MD557401e5fd7f02d0a5dd8739c55df638e
SHA167edbf6ca8960d1c1f05e0fa33500a711d01b0be
SHA256de367bde6d9ddd5c8b3a66d273e3d7a229b50b01b0297a5336171c25c20a82a5
SHA5128cecf8309184551275880294cd5b1f4739f505e334718fc4601ebf4cda6f79847de23db7112540f563e51bf4644b83362d235b63f7fdc0bb2aef51d8d59c8b08