Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 11:49
Static task
static1
General
-
Target
864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf.exe
-
Size
376KB
-
MD5
e786a61ecb116a05e7e2b5ded2169fd2
-
SHA1
c61df107ff0db3ab19948cfb3ff4461e637f1b99
-
SHA256
864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf
-
SHA512
713af8d16d08c27a191c3ae8e3c9d80aa7e6f87062a3b90fd5cb55538e7e4d1b592555dbd97bf1893ba31255f46c3c2448591caa37a59cdfddacb53782e7886c
-
SSDEEP
6144:KEy+bnr+Fp0yN90QEcBONe5b5is86g/hFA8pXcHw/Z04/4kfdaKL4RJVVL:EMr9y904O+ErFA8tcQ/ZhQw83JbL
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k6425377.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k6425377.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection k6425377.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k6425377.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k6425377.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k6425377.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation m1263344.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 3816 y3381393.exe 2660 k6425377.exe 3644 l8938679.exe 1972 m1263344.exe 1580 oneetx.exe 3748 oneetx.exe 4668 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 2676 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" k6425377.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y3381393.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y3381393.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2236 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2660 k6425377.exe 2660 k6425377.exe 3644 l8938679.exe 3644 l8938679.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2660 k6425377.exe Token: SeDebugPrivilege 3644 l8938679.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1972 m1263344.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1128 wrote to memory of 3816 1128 864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf.exe 85 PID 1128 wrote to memory of 3816 1128 864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf.exe 85 PID 1128 wrote to memory of 3816 1128 864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf.exe 85 PID 3816 wrote to memory of 2660 3816 y3381393.exe 86 PID 3816 wrote to memory of 2660 3816 y3381393.exe 86 PID 3816 wrote to memory of 3644 3816 y3381393.exe 93 PID 3816 wrote to memory of 3644 3816 y3381393.exe 93 PID 3816 wrote to memory of 3644 3816 y3381393.exe 93 PID 1128 wrote to memory of 1972 1128 864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf.exe 94 PID 1128 wrote to memory of 1972 1128 864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf.exe 94 PID 1128 wrote to memory of 1972 1128 864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf.exe 94 PID 1972 wrote to memory of 1580 1972 m1263344.exe 95 PID 1972 wrote to memory of 1580 1972 m1263344.exe 95 PID 1972 wrote to memory of 1580 1972 m1263344.exe 95 PID 1580 wrote to memory of 2236 1580 oneetx.exe 96 PID 1580 wrote to memory of 2236 1580 oneetx.exe 96 PID 1580 wrote to memory of 2236 1580 oneetx.exe 96 PID 1580 wrote to memory of 4348 1580 oneetx.exe 98 PID 1580 wrote to memory of 4348 1580 oneetx.exe 98 PID 1580 wrote to memory of 4348 1580 oneetx.exe 98 PID 4348 wrote to memory of 5088 4348 cmd.exe 100 PID 4348 wrote to memory of 5088 4348 cmd.exe 100 PID 4348 wrote to memory of 5088 4348 cmd.exe 100 PID 4348 wrote to memory of 4616 4348 cmd.exe 101 PID 4348 wrote to memory of 4616 4348 cmd.exe 101 PID 4348 wrote to memory of 4616 4348 cmd.exe 101 PID 4348 wrote to memory of 428 4348 cmd.exe 102 PID 4348 wrote to memory of 428 4348 cmd.exe 102 PID 4348 wrote to memory of 428 4348 cmd.exe 102 PID 4348 wrote to memory of 4144 4348 cmd.exe 104 PID 4348 wrote to memory of 4144 4348 cmd.exe 104 PID 4348 wrote to memory of 4144 4348 cmd.exe 104 PID 4348 wrote to memory of 5100 4348 cmd.exe 103 PID 4348 wrote to memory of 5100 4348 cmd.exe 103 PID 4348 wrote to memory of 5100 4348 cmd.exe 103 PID 4348 wrote to memory of 4604 4348 cmd.exe 105 PID 4348 wrote to memory of 4604 4348 cmd.exe 105 PID 4348 wrote to memory of 4604 4348 cmd.exe 105 PID 1580 wrote to memory of 2676 1580 oneetx.exe 109 PID 1580 wrote to memory of 2676 1580 oneetx.exe 109 PID 1580 wrote to memory of 2676 1580 oneetx.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf.exe"C:\Users\Admin\AppData\Local\Temp\864dbbedbc85162606343c0d73196de09f03ce7b536fbd6865e8023ee63c9ebf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3381393.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3381393.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6425377.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k6425377.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8938679.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8938679.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m1263344.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m1263344.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2236
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:5088
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4616
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:428
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:5100
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4144
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:4604
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:2676
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:3748
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4668
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD56c21bbeac6b5744bd494232b0fc28e1b
SHA1c18d25972293ca56c7d70a0c1502e4cd0efd7cb2
SHA25678388707ea39062d5350e6077895effcf656a78f7387e66452b2512dfc00d653
SHA51298c5a6da599d60bc842a43b4f94a7adfd3a2b2e3f3302db7af051aea06876112ce00179ff6b63de281f05c7f7f63cd2db722e994a22bde7351acbbd9dc2dd6d1
-
Filesize
204KB
MD56c21bbeac6b5744bd494232b0fc28e1b
SHA1c18d25972293ca56c7d70a0c1502e4cd0efd7cb2
SHA25678388707ea39062d5350e6077895effcf656a78f7387e66452b2512dfc00d653
SHA51298c5a6da599d60bc842a43b4f94a7adfd3a2b2e3f3302db7af051aea06876112ce00179ff6b63de281f05c7f7f63cd2db722e994a22bde7351acbbd9dc2dd6d1
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
136KB
MD5895475766334560349830766165b8fb1
SHA1b1870d5a15d318dccff6d519ecfdbed145c4df71
SHA2564883add1be8a6becf34ffa33b2aa8127fd85b243ce3839d7d7ae6adf01f861c1
SHA512dc11db7a7565353bbf11db9030c43105dad5059b41e9cfcbaed7c1590c2bb697f25138a2c1cc42f14c73931353b3a9c60d35f961a125e608164cc90c1d375ea1
-
Filesize
136KB
MD5895475766334560349830766165b8fb1
SHA1b1870d5a15d318dccff6d519ecfdbed145c4df71
SHA2564883add1be8a6becf34ffa33b2aa8127fd85b243ce3839d7d7ae6adf01f861c1
SHA512dc11db7a7565353bbf11db9030c43105dad5059b41e9cfcbaed7c1590c2bb697f25138a2c1cc42f14c73931353b3a9c60d35f961a125e608164cc90c1d375ea1
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5