Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10/05/2023, 09:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
PO FILE87965345 exl.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
PO FILE87965345 exl.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
PO FILE87965345 exl.exe
-
Size
1.8MB
-
MD5
26fa36b587e07bde2d99f329ba553e9c
-
SHA1
5d2b42a954666f85fcf91475c3ec361c4c254764
-
SHA256
511bd4f1051444242dda8ae6df80720106a6b4d60eab89658baffb142affe730
-
SHA512
413bf79332518b6af56cc23c162d2b981a94744e463b1a01ab8f3699c681cad077d177e3213132d1791969810bc7065667b331deb4f51570a31c96a625b4c694
-
SSDEEP
12288:9d7uix2TBXVnBGw4I/6QTdp7lRpIlfMer5iiTvdyEp8NMXzp4J2cT3RnnrgYs3aF:98MXzCYqBrfGadT
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\htv.exe," reg.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 1956 PING.EXE 692 PING.EXE 1592 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe 848 PO FILE87965345 exl.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 848 PO FILE87965345 exl.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 848 wrote to memory of 1060 848 PO FILE87965345 exl.exe 28 PID 848 wrote to memory of 1060 848 PO FILE87965345 exl.exe 28 PID 848 wrote to memory of 1060 848 PO FILE87965345 exl.exe 28 PID 848 wrote to memory of 1060 848 PO FILE87965345 exl.exe 28 PID 1060 wrote to memory of 1956 1060 cmd.exe 30 PID 1060 wrote to memory of 1956 1060 cmd.exe 30 PID 1060 wrote to memory of 1956 1060 cmd.exe 30 PID 1060 wrote to memory of 1956 1060 cmd.exe 30 PID 848 wrote to memory of 1500 848 PO FILE87965345 exl.exe 31 PID 848 wrote to memory of 1500 848 PO FILE87965345 exl.exe 31 PID 848 wrote to memory of 1500 848 PO FILE87965345 exl.exe 31 PID 848 wrote to memory of 1500 848 PO FILE87965345 exl.exe 31 PID 1500 wrote to memory of 692 1500 cmd.exe 33 PID 1500 wrote to memory of 692 1500 cmd.exe 33 PID 1500 wrote to memory of 692 1500 cmd.exe 33 PID 1500 wrote to memory of 692 1500 cmd.exe 33 PID 1060 wrote to memory of 1916 1060 cmd.exe 34 PID 1060 wrote to memory of 1916 1060 cmd.exe 34 PID 1060 wrote to memory of 1916 1060 cmd.exe 34 PID 1060 wrote to memory of 1916 1060 cmd.exe 34 PID 1500 wrote to memory of 1592 1500 cmd.exe 35 PID 1500 wrote to memory of 1592 1500 cmd.exe 35 PID 1500 wrote to memory of 1592 1500 cmd.exe 35 PID 1500 wrote to memory of 1592 1500 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO FILE87965345 exl.exe"C:\Users\Admin\AppData\Local\Temp\PO FILE87965345 exl.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 37 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\htv.exe,"2⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 373⤵
- Runs ping.exe
PID:1956
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\htv.exe,"3⤵
- Modifies WinLogon for persistence
PID:1916
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 37 > nul && copy "C:\Users\Admin\AppData\Local\Temp\PO FILE87965345 exl.exe" "C:\Users\Admin\AppData\Local\htv.exe" && ping 127.0.0.1 -n 37 > nul && "C:\Users\Admin\AppData\Local\htv.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 373⤵
- Runs ping.exe
PID:692
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 373⤵
- Runs ping.exe
PID:1592
-
-