Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 04:01
Static task
static1
General
-
Target
708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de.exe
-
Size
376KB
-
MD5
4d36964e6a13cdad5f6da9fa38e3ce37
-
SHA1
331a6faa359e4c5150cdd782f955fc840f6a4e95
-
SHA256
708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de
-
SHA512
5d6c24b840a99ae75f7d49d449a68a2f96a968b5a512aa41268af32be2a9f12a673475f7dc261272695eca6ac79931d9de35eff5b8db67f38ce8c86f0f5eda0c
-
SSDEEP
6144:Kzy+bnr+Cp0yN90QE/oJEdrqCnEvbvIEp6ZTaMkvyR2GI60E1hng2VDPSPxoCdjR:JMryy900QEcwER86/LndDYZjt8g
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a0104535.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection a0104535.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a0104535.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a0104535.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a0104535.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a0104535.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation d0524232.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 4592 v0412498.exe 2664 a0104535.exe 1652 b7075828.exe 2872 d0524232.exe 4528 oneetx.exe 4664 oneetx.exe 2024 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 5068 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a0104535.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v0412498.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v0412498.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1104 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2664 a0104535.exe 2664 a0104535.exe 1652 b7075828.exe 1652 b7075828.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2664 a0104535.exe Token: SeDebugPrivilege 1652 b7075828.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2872 d0524232.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4416 wrote to memory of 4592 4416 708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de.exe 83 PID 4416 wrote to memory of 4592 4416 708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de.exe 83 PID 4416 wrote to memory of 4592 4416 708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de.exe 83 PID 4592 wrote to memory of 2664 4592 v0412498.exe 84 PID 4592 wrote to memory of 2664 4592 v0412498.exe 84 PID 4592 wrote to memory of 1652 4592 v0412498.exe 89 PID 4592 wrote to memory of 1652 4592 v0412498.exe 89 PID 4592 wrote to memory of 1652 4592 v0412498.exe 89 PID 4416 wrote to memory of 2872 4416 708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de.exe 93 PID 4416 wrote to memory of 2872 4416 708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de.exe 93 PID 4416 wrote to memory of 2872 4416 708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de.exe 93 PID 2872 wrote to memory of 4528 2872 d0524232.exe 94 PID 2872 wrote to memory of 4528 2872 d0524232.exe 94 PID 2872 wrote to memory of 4528 2872 d0524232.exe 94 PID 4528 wrote to memory of 1104 4528 oneetx.exe 95 PID 4528 wrote to memory of 1104 4528 oneetx.exe 95 PID 4528 wrote to memory of 1104 4528 oneetx.exe 95 PID 4528 wrote to memory of 1460 4528 oneetx.exe 97 PID 4528 wrote to memory of 1460 4528 oneetx.exe 97 PID 4528 wrote to memory of 1460 4528 oneetx.exe 97 PID 1460 wrote to memory of 3696 1460 cmd.exe 99 PID 1460 wrote to memory of 3696 1460 cmd.exe 99 PID 1460 wrote to memory of 3696 1460 cmd.exe 99 PID 1460 wrote to memory of 3492 1460 cmd.exe 100 PID 1460 wrote to memory of 3492 1460 cmd.exe 100 PID 1460 wrote to memory of 3492 1460 cmd.exe 100 PID 1460 wrote to memory of 3952 1460 cmd.exe 101 PID 1460 wrote to memory of 3952 1460 cmd.exe 101 PID 1460 wrote to memory of 3952 1460 cmd.exe 101 PID 1460 wrote to memory of 5056 1460 cmd.exe 102 PID 1460 wrote to memory of 5056 1460 cmd.exe 102 PID 1460 wrote to memory of 5056 1460 cmd.exe 102 PID 1460 wrote to memory of 2312 1460 cmd.exe 103 PID 1460 wrote to memory of 2312 1460 cmd.exe 103 PID 1460 wrote to memory of 2312 1460 cmd.exe 103 PID 1460 wrote to memory of 1408 1460 cmd.exe 104 PID 1460 wrote to memory of 1408 1460 cmd.exe 104 PID 1460 wrote to memory of 1408 1460 cmd.exe 104 PID 4528 wrote to memory of 5068 4528 oneetx.exe 106 PID 4528 wrote to memory of 5068 4528 oneetx.exe 106 PID 4528 wrote to memory of 5068 4528 oneetx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de.exe"C:\Users\Admin\AppData\Local\Temp\708610268fd91394339178b5cd4b2bfb65783554853e09b29d8b6d7bb576d7de.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0412498.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v0412498.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0104535.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a0104535.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7075828.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b7075828.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0524232.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d0524232.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:1104
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3696
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:3492
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:3952
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:5056
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:2312
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:1408
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:5068
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4664
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:2024
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5ab70ed118da02720aebb36d7cc0e4f54
SHA13df502e3fcb2433a1710febbe827e6e5fa8902c0
SHA25638ea9317ddf1333fd027180fac363f4e4a3207dc078949d997323de29061a795
SHA5126454361eb1f4d2f8aaa3c12fc941e50143eb358a1c2e7350e3d97652605aa23ed955637c64adfede6e64f044364cfda51a1095e51dba66d9c347ffd5b234de5d
-
Filesize
204KB
MD5ab70ed118da02720aebb36d7cc0e4f54
SHA13df502e3fcb2433a1710febbe827e6e5fa8902c0
SHA25638ea9317ddf1333fd027180fac363f4e4a3207dc078949d997323de29061a795
SHA5126454361eb1f4d2f8aaa3c12fc941e50143eb358a1c2e7350e3d97652605aa23ed955637c64adfede6e64f044364cfda51a1095e51dba66d9c347ffd5b234de5d
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
136KB
MD530d0ee0947be55272def37f502e40d83
SHA167dec087565870ddbba362f33bc909491d56f0d7
SHA256876c00366d8cdda682030628307cbcbd8a90ffc831cb0176173207b36bf28514
SHA5120b98ba7648398642441894a970d889d0d4769317531473def2decb847bdb9472b0b3671f96126ad7ad023d4a434cbcef8da7c8663df718dcf6ee3557874ad284
-
Filesize
136KB
MD530d0ee0947be55272def37f502e40d83
SHA167dec087565870ddbba362f33bc909491d56f0d7
SHA256876c00366d8cdda682030628307cbcbd8a90ffc831cb0176173207b36bf28514
SHA5120b98ba7648398642441894a970d889d0d4769317531473def2decb847bdb9472b0b3671f96126ad7ad023d4a434cbcef8da7c8663df718dcf6ee3557874ad284
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5