Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 19:01
Static task
static1
Behavioral task
behavioral1
Sample
fd08be7bfc5351e0adb51643e96c9ba3.exe
Resource
win7-20230220-en
General
-
Target
fd08be7bfc5351e0adb51643e96c9ba3.exe
-
Size
480KB
-
MD5
fd08be7bfc5351e0adb51643e96c9ba3
-
SHA1
bf9960400999e949cee0c620e6a6211fc664d0f3
-
SHA256
fcf08da4f99acde5a1ecc10428a12f1317ffe341f75209d46dbf187f969b1d70
-
SHA512
1c7a16ac949a7e8bced5355aa77634b2682e48dcf38981b2b13605275f9218864997121ced734ef97eb28d2709815a74c4118fbcb25bd51bc2e9a7f49f9ec834
-
SSDEEP
12288:hMrKy90vJV/y47qd+ZeJaI1rkkVPva2F7okq/A:PyAX64reJLV3a2RoY
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" k9012518.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection k9012518.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" k9012518.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" k9012518.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" k9012518.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" k9012518.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation m1402807.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 7 IoCs
pid Process 2628 y7569253.exe 1888 k9012518.exe 3980 l5155097.exe 2100 m1402807.exe 1556 oneetx.exe 2580 oneetx.exe 1688 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 5064 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features k9012518.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" k9012518.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fd08be7bfc5351e0adb51643e96c9ba3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fd08be7bfc5351e0adb51643e96c9ba3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce y7569253.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y7569253.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4064 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1888 k9012518.exe 1888 k9012518.exe 3980 l5155097.exe 3980 l5155097.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1888 k9012518.exe Token: SeDebugPrivilege 3980 l5155097.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 m1402807.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4988 wrote to memory of 2628 4988 fd08be7bfc5351e0adb51643e96c9ba3.exe 81 PID 4988 wrote to memory of 2628 4988 fd08be7bfc5351e0adb51643e96c9ba3.exe 81 PID 4988 wrote to memory of 2628 4988 fd08be7bfc5351e0adb51643e96c9ba3.exe 81 PID 2628 wrote to memory of 1888 2628 y7569253.exe 82 PID 2628 wrote to memory of 1888 2628 y7569253.exe 82 PID 2628 wrote to memory of 1888 2628 y7569253.exe 82 PID 2628 wrote to memory of 3980 2628 y7569253.exe 85 PID 2628 wrote to memory of 3980 2628 y7569253.exe 85 PID 2628 wrote to memory of 3980 2628 y7569253.exe 85 PID 4988 wrote to memory of 2100 4988 fd08be7bfc5351e0adb51643e96c9ba3.exe 86 PID 4988 wrote to memory of 2100 4988 fd08be7bfc5351e0adb51643e96c9ba3.exe 86 PID 4988 wrote to memory of 2100 4988 fd08be7bfc5351e0adb51643e96c9ba3.exe 86 PID 2100 wrote to memory of 1556 2100 m1402807.exe 87 PID 2100 wrote to memory of 1556 2100 m1402807.exe 87 PID 2100 wrote to memory of 1556 2100 m1402807.exe 87 PID 1556 wrote to memory of 4064 1556 oneetx.exe 88 PID 1556 wrote to memory of 4064 1556 oneetx.exe 88 PID 1556 wrote to memory of 4064 1556 oneetx.exe 88 PID 1556 wrote to memory of 4864 1556 oneetx.exe 90 PID 1556 wrote to memory of 4864 1556 oneetx.exe 90 PID 1556 wrote to memory of 4864 1556 oneetx.exe 90 PID 4864 wrote to memory of 4880 4864 cmd.exe 92 PID 4864 wrote to memory of 4880 4864 cmd.exe 92 PID 4864 wrote to memory of 4880 4864 cmd.exe 92 PID 4864 wrote to memory of 4932 4864 cmd.exe 93 PID 4864 wrote to memory of 4932 4864 cmd.exe 93 PID 4864 wrote to memory of 4932 4864 cmd.exe 93 PID 4864 wrote to memory of 3344 4864 cmd.exe 94 PID 4864 wrote to memory of 3344 4864 cmd.exe 94 PID 4864 wrote to memory of 3344 4864 cmd.exe 94 PID 4864 wrote to memory of 3536 4864 cmd.exe 96 PID 4864 wrote to memory of 3536 4864 cmd.exe 96 PID 4864 wrote to memory of 3536 4864 cmd.exe 96 PID 4864 wrote to memory of 2212 4864 cmd.exe 95 PID 4864 wrote to memory of 2212 4864 cmd.exe 95 PID 4864 wrote to memory of 2212 4864 cmd.exe 95 PID 4864 wrote to memory of 2116 4864 cmd.exe 97 PID 4864 wrote to memory of 2116 4864 cmd.exe 97 PID 4864 wrote to memory of 2116 4864 cmd.exe 97 PID 1556 wrote to memory of 5064 1556 oneetx.exe 99 PID 1556 wrote to memory of 5064 1556 oneetx.exe 99 PID 1556 wrote to memory of 5064 1556 oneetx.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd08be7bfc5351e0adb51643e96c9ba3.exe"C:\Users\Admin\AppData\Local\Temp\fd08be7bfc5351e0adb51643e96c9ba3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7569253.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7569253.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9012518.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k9012518.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5155097.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l5155097.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3980
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m1402807.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\m1402807.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4064
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4880
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:4932
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:3344
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:2212
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3536
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:2116
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:5064
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:2580
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:1688
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
308KB
MD5bbef51814c20d0ad41e97613d93afc41
SHA1c013726ab4005fff9189e4dcf06da0f79b03c2a6
SHA2569037bcae819055097f07a05fd4349880411a62251dcf5ad8251a85e373e12d30
SHA5121ca16a70d94e03aabc7fe87db46f992b5de42a14470d4a955157a1269576d18656f25e7c0c9e7d01b744a89951972c2706aa8e1b04c3c984ff07eb81aeac6d04
-
Filesize
308KB
MD5bbef51814c20d0ad41e97613d93afc41
SHA1c013726ab4005fff9189e4dcf06da0f79b03c2a6
SHA2569037bcae819055097f07a05fd4349880411a62251dcf5ad8251a85e373e12d30
SHA5121ca16a70d94e03aabc7fe87db46f992b5de42a14470d4a955157a1269576d18656f25e7c0c9e7d01b744a89951972c2706aa8e1b04c3c984ff07eb81aeac6d04
-
Filesize
175KB
MD5230c68a6f80a6edf574fae1a8be9dcb0
SHA1d9ac6ed57d69c392b76efc025f26766c436a42cf
SHA2568c995476c2c725fb69a3dd691a43e6fe55bc55c86f3d7738ebf2f303b1f03b19
SHA512db64974fa339fda38605df04631f4a7fdb32cfcc8c896b67b154e5d156f4f8d80e79520cfacc44444c19e8e0404d2a790d34c828d003a21ad59224235ead38bb
-
Filesize
175KB
MD5230c68a6f80a6edf574fae1a8be9dcb0
SHA1d9ac6ed57d69c392b76efc025f26766c436a42cf
SHA2568c995476c2c725fb69a3dd691a43e6fe55bc55c86f3d7738ebf2f303b1f03b19
SHA512db64974fa339fda38605df04631f4a7fdb32cfcc8c896b67b154e5d156f4f8d80e79520cfacc44444c19e8e0404d2a790d34c828d003a21ad59224235ead38bb
-
Filesize
136KB
MD5eaa4ed1db1adb0a85b6331621b95aaec
SHA16b077181b0a43641d2f802e7a799759472020fd4
SHA256b31c622ca162c6939e717219a31d13fcc273f0a1a6fce53b5bc11e28ff839fd2
SHA512c3e8f17021db6552351705693fb3de7f921ac6cb447439cc51960a9ebff7621c41ac3a5df93a269d95145c8b594941be20d65a74f23278bc051fd873559c0fe0
-
Filesize
136KB
MD5eaa4ed1db1adb0a85b6331621b95aaec
SHA16b077181b0a43641d2f802e7a799759472020fd4
SHA256b31c622ca162c6939e717219a31d13fcc273f0a1a6fce53b5bc11e28ff839fd2
SHA512c3e8f17021db6552351705693fb3de7f921ac6cb447439cc51960a9ebff7621c41ac3a5df93a269d95145c8b594941be20d65a74f23278bc051fd873559c0fe0
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
204KB
MD5c14869045ea50a4368e015350d349b81
SHA1f0515e00463d02b8cd9404a0b2b4ba21e2155fac
SHA256454da82a4921c2826b942421cfd4c066242abbb6bb079f9be478c10026640196
SHA51214456e2d4be1670573d3dd9c3cac91317c52f7dc4c9e5632bfae7f19cc6e073adb2a5a55ee8e7f920f3b4fabd2e95082f0a5650190aad9b0663450fa583dee22
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5