Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 10:07
Static task
static1
General
-
Target
565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f.exe
-
Size
480KB
-
MD5
c83ea285205896d468025ab6e0b1b3d0
-
SHA1
42cb1211da1973b6ab020c99a2604629a4a345d7
-
SHA256
565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f
-
SHA512
c127c8db468a49efef812a518f0d4801a031b6659f0183f4405b422ced6114095cdee65a679aeda3a96aab14d87739828d6831e57717e1358697a93d0037c5a2
-
SSDEEP
12288:wMruy90ivQdSKqJvMixh6vsPthdNp9IK7QcEpy5S:OyVvILqJ9xhsYPdDSK7Ds/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection k2425807.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k2425807.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k2425807.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k2425807.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k2425807.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k2425807.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation m9171309.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 3676 y1561436.exe 4008 k2425807.exe 2812 l1249563.exe 2676 m9171309.exe 3488 oneetx.exe 4440 oneetx.exe 4448 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 4112 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features k2425807.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k2425807.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y1561436.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y1561436.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2268 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4008 k2425807.exe 4008 k2425807.exe 2812 l1249563.exe 2812 l1249563.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4008 k2425807.exe Token: SeDebugPrivilege 2812 l1249563.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2676 m9171309.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2320 wrote to memory of 3676 2320 565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f.exe 84 PID 2320 wrote to memory of 3676 2320 565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f.exe 84 PID 2320 wrote to memory of 3676 2320 565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f.exe 84 PID 3676 wrote to memory of 4008 3676 y1561436.exe 85 PID 3676 wrote to memory of 4008 3676 y1561436.exe 85 PID 3676 wrote to memory of 4008 3676 y1561436.exe 85 PID 3676 wrote to memory of 2812 3676 y1561436.exe 88 PID 3676 wrote to memory of 2812 3676 y1561436.exe 88 PID 3676 wrote to memory of 2812 3676 y1561436.exe 88 PID 2320 wrote to memory of 2676 2320 565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f.exe 89 PID 2320 wrote to memory of 2676 2320 565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f.exe 89 PID 2320 wrote to memory of 2676 2320 565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f.exe 89 PID 2676 wrote to memory of 3488 2676 m9171309.exe 90 PID 2676 wrote to memory of 3488 2676 m9171309.exe 90 PID 2676 wrote to memory of 3488 2676 m9171309.exe 90 PID 3488 wrote to memory of 2268 3488 oneetx.exe 91 PID 3488 wrote to memory of 2268 3488 oneetx.exe 91 PID 3488 wrote to memory of 2268 3488 oneetx.exe 91 PID 3488 wrote to memory of 4764 3488 oneetx.exe 93 PID 3488 wrote to memory of 4764 3488 oneetx.exe 93 PID 3488 wrote to memory of 4764 3488 oneetx.exe 93 PID 4764 wrote to memory of 3516 4764 cmd.exe 95 PID 4764 wrote to memory of 3516 4764 cmd.exe 95 PID 4764 wrote to memory of 3516 4764 cmd.exe 95 PID 4764 wrote to memory of 3496 4764 cmd.exe 96 PID 4764 wrote to memory of 3496 4764 cmd.exe 96 PID 4764 wrote to memory of 3496 4764 cmd.exe 96 PID 4764 wrote to memory of 1600 4764 cmd.exe 97 PID 4764 wrote to memory of 1600 4764 cmd.exe 97 PID 4764 wrote to memory of 1600 4764 cmd.exe 97 PID 4764 wrote to memory of 4868 4764 cmd.exe 98 PID 4764 wrote to memory of 4868 4764 cmd.exe 98 PID 4764 wrote to memory of 4868 4764 cmd.exe 98 PID 4764 wrote to memory of 4372 4764 cmd.exe 99 PID 4764 wrote to memory of 4372 4764 cmd.exe 99 PID 4764 wrote to memory of 4372 4764 cmd.exe 99 PID 4764 wrote to memory of 3600 4764 cmd.exe 100 PID 4764 wrote to memory of 3600 4764 cmd.exe 100 PID 4764 wrote to memory of 3600 4764 cmd.exe 100 PID 3488 wrote to memory of 4112 3488 oneetx.exe 102 PID 3488 wrote to memory of 4112 3488 oneetx.exe 102 PID 3488 wrote to memory of 4112 3488 oneetx.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f.exe"C:\Users\Admin\AppData\Local\Temp\565dd3480c46a027b68f9fecebd01c3656c5f852935b128a0242328708ebdc9f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1561436.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1561436.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2425807.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2425807.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1249563.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l1249563.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m9171309.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m9171309.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2268
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3516
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:3496
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:1600
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4868
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:4372
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:3600
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:4112
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4440
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4448
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
308KB
MD51ab0e7aedc14db9bdaa7110e17615098
SHA16f07b0f0b94e2533c26641072779c263850def5c
SHA25639e79ef875bb57459cf9c6dead758f5f5af8befd3f7622fdc23d3c5f604fcc2b
SHA51284f63d2a2339923bfc8632db19a43d16c8d30f0d670010428f468554d266865d13a177792d09b922890d192e9974fcc3d619964f8fecc543e397a12a13aa6fc1
-
Filesize
308KB
MD51ab0e7aedc14db9bdaa7110e17615098
SHA16f07b0f0b94e2533c26641072779c263850def5c
SHA25639e79ef875bb57459cf9c6dead758f5f5af8befd3f7622fdc23d3c5f604fcc2b
SHA51284f63d2a2339923bfc8632db19a43d16c8d30f0d670010428f468554d266865d13a177792d09b922890d192e9974fcc3d619964f8fecc543e397a12a13aa6fc1
-
Filesize
175KB
MD568a3a79cf7aa67c73ae77759580855bb
SHA1f7be3508436fbdea2760f45b3c8db56d62cdd017
SHA256c48aec0660b078fdbdb082d1ac172c989a3f24779c228dfcde3443d90c242bf7
SHA512d7972c897970e162b6ac9552d738b63f2b163c34ab8dfd5e94480fe711da715e3f11e9febd53d83995c16cc0806daf37d05c1e3c54f15589624e8b574e546592
-
Filesize
175KB
MD568a3a79cf7aa67c73ae77759580855bb
SHA1f7be3508436fbdea2760f45b3c8db56d62cdd017
SHA256c48aec0660b078fdbdb082d1ac172c989a3f24779c228dfcde3443d90c242bf7
SHA512d7972c897970e162b6ac9552d738b63f2b163c34ab8dfd5e94480fe711da715e3f11e9febd53d83995c16cc0806daf37d05c1e3c54f15589624e8b574e546592
-
Filesize
136KB
MD58f30f7f88229560306c5959c605316de
SHA136f26a905a9743f6dd1608e39b37d1116cafcc0a
SHA2563a616b322cc7ca87e349b8ceabb92062ed0388308d1f9221e9cdb6f65c86b6f7
SHA512267d0f3954c416dc994e3c3e6790f6997598b71fdb7172e87265b31b7593fb29e9eb4cc295a38b969d1f2aa131b5a67525e0f4bb51a61a3dd82b7c63b867f9a0
-
Filesize
136KB
MD58f30f7f88229560306c5959c605316de
SHA136f26a905a9743f6dd1608e39b37d1116cafcc0a
SHA2563a616b322cc7ca87e349b8ceabb92062ed0388308d1f9221e9cdb6f65c86b6f7
SHA512267d0f3954c416dc994e3c3e6790f6997598b71fdb7172e87265b31b7593fb29e9eb4cc295a38b969d1f2aa131b5a67525e0f4bb51a61a3dd82b7c63b867f9a0
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5