Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
20s -
max time network
25s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2023, 14:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Microsoft Exchange Services Health.exe
Resource
win7-20230220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Microsoft Exchange Services Health.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
Microsoft Exchange Services Health.exe
-
Size
30KB
-
MD5
4b079c6c0c25d81c65c94f502f4bd148
-
SHA1
53ae850bdbdead557255e0d0a5a7fc0b6d119c45
-
SHA256
2fd6984975fe63d3299e1aab2220d15445ea5509e7ae9f308828b01db63b4996
-
SHA512
955bec03df5b6f2fb8c05aad91d3ca54d2695ec129f355aead5a917a865c3dc977d6299571c73ed029a85bf500684b40c6f65e93b97860e219caa23041c1060f
-
SSDEEP
768:hEHZnhI0GaRHV/RWM41v1BbpChP1o2gm3Htd:hEHZjetM5LX3v
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "247" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4240 Microsoft Exchange Services Health.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeIncreaseQuotaPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeSecurityPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeTakeOwnershipPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeLoadDriverPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeSystemProfilePrivilege 4240 Microsoft Exchange Services Health.exe Token: SeSystemtimePrivilege 4240 Microsoft Exchange Services Health.exe Token: SeProfSingleProcessPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeIncBasePriorityPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeCreatePagefilePrivilege 4240 Microsoft Exchange Services Health.exe Token: SeBackupPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeRestorePrivilege 4240 Microsoft Exchange Services Health.exe Token: SeShutdownPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeDebugPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeSystemEnvironmentPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeRemoteShutdownPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeUndockPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeManageVolumePrivilege 4240 Microsoft Exchange Services Health.exe Token: 33 4240 Microsoft Exchange Services Health.exe Token: 34 4240 Microsoft Exchange Services Health.exe Token: 35 4240 Microsoft Exchange Services Health.exe Token: 36 4240 Microsoft Exchange Services Health.exe Token: SeIncreaseQuotaPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeSecurityPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeTakeOwnershipPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeLoadDriverPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeSystemProfilePrivilege 4240 Microsoft Exchange Services Health.exe Token: SeSystemtimePrivilege 4240 Microsoft Exchange Services Health.exe Token: SeProfSingleProcessPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeIncBasePriorityPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeCreatePagefilePrivilege 4240 Microsoft Exchange Services Health.exe Token: SeBackupPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeRestorePrivilege 4240 Microsoft Exchange Services Health.exe Token: SeShutdownPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeDebugPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeSystemEnvironmentPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeRemoteShutdownPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeUndockPrivilege 4240 Microsoft Exchange Services Health.exe Token: SeManageVolumePrivilege 4240 Microsoft Exchange Services Health.exe Token: 33 4240 Microsoft Exchange Services Health.exe Token: 34 4240 Microsoft Exchange Services Health.exe Token: 35 4240 Microsoft Exchange Services Health.exe Token: 36 4240 Microsoft Exchange Services Health.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4608 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Exchange Services Health.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Exchange Services Health.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3982855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4608
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82