Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
07/05/2023, 19:09
230507-xt4dssfe62 307/05/2023, 19:04
230507-xq8jcahc8x 307/05/2023, 19:01
230507-xpdmkshc71 10Analysis
-
max time kernel
151s -
max time network
66s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07/05/2023, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
empty.jpg
Resource
win7-20230220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
empty.jpg
Resource
win10v2004-20230220-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
empty.jpg
-
Size
55KB
-
MD5
f7796b4270e876b8acf653c1632f2626
-
SHA1
e8fbb0a599801f8698dd4753e390294614bfe833
-
SHA256
b095ef14c5f8a5fdab59b407ae3117a942928b361a2af0a574e3046431f9f907
-
SHA512
3cc5ef085f4784d3416cdd94415e02fe4cd6e445eff7c3c85d7daa2d039a5ad2f053cd1960b9c13c818ca67abc77304d2bb0caa6565f0687d788a525945dcb64
-
SSDEEP
1536:DfJMSeftY5lmSF6KQtsh/tjXCiFyUNien:rotEdFV7fLFxhn
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 32 IoCs
description ioc Process Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeShutdownPrivilege 1528 LogonUI.exe Token: SeSecurityPrivilege 1436 winlogon.exe Token: SeBackupPrivilege 1436 winlogon.exe Token: SeSecurityPrivilege 1436 winlogon.exe Token: SeTcbPrivilege 1436 winlogon.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 628 rundll32.exe 628 rundll32.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1372 1908 cmd.exe 34 PID 1908 wrote to memory of 1372 1908 cmd.exe 34 PID 1908 wrote to memory of 1372 1908 cmd.exe 34 PID 1372 wrote to memory of 856 1372 net.exe 35 PID 1372 wrote to memory of 856 1372 net.exe 35 PID 1372 wrote to memory of 856 1372 net.exe 35 PID 1908 wrote to memory of 940 1908 cmd.exe 36 PID 1908 wrote to memory of 940 1908 cmd.exe 36 PID 1908 wrote to memory of 940 1908 cmd.exe 36 PID 1708 wrote to memory of 1528 1708 csrss.exe 41 PID 1708 wrote to memory of 1528 1708 csrss.exe 41 PID 1436 wrote to memory of 1528 1436 winlogon.exe 41 PID 1436 wrote to memory of 1528 1436 winlogon.exe 41 PID 1436 wrote to memory of 1528 1436 winlogon.exe 41 PID 1708 wrote to memory of 1528 1708 csrss.exe 41 PID 1708 wrote to memory of 1528 1708 csrss.exe 41 PID 1708 wrote to memory of 1528 1708 csrss.exe 41 PID 1708 wrote to memory of 1528 1708 csrss.exe 41 PID 1708 wrote to memory of 1528 1708 csrss.exe 41 PID 1708 wrote to memory of 1528 1708 csrss.exe 41 PID 1708 wrote to memory of 1528 1708 csrss.exe 41 PID 1708 wrote to memory of 1528 1708 csrss.exe 41 PID 1708 wrote to memory of 1908 1708 csrss.exe 42 PID 1708 wrote to memory of 1908 1708 csrss.exe 42 PID 1436 wrote to memory of 1908 1436 winlogon.exe 42 PID 1436 wrote to memory of 1908 1436 winlogon.exe 42 PID 1436 wrote to memory of 1908 1436 winlogon.exe 42 PID 1708 wrote to memory of 1908 1708 csrss.exe 42 PID 1708 wrote to memory of 1908 1708 csrss.exe 42
Processes
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\empty.jpg1⤵
- Suspicious use of FindShellTrayWindow
PID:628
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\net.exenet user administrator /active:yes2⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user administrator /active:yes3⤵PID:856
-
-
-
C:\Windows\system32\shutdown.exeshutdown /l2⤵PID:940
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1720
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1708
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
C:\Windows\system32\sethc.exesethc.exe 2112⤵PID:1908
-