Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2023, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
PO FILE87965345 exl.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PO FILE87965345 exl.exe
Resource
win10v2004-20230220-en
General
-
Target
PO FILE87965345 exl.exe
-
Size
1.8MB
-
MD5
26fa36b587e07bde2d99f329ba553e9c
-
SHA1
5d2b42a954666f85fcf91475c3ec361c4c254764
-
SHA256
511bd4f1051444242dda8ae6df80720106a6b4d60eab89658baffb142affe730
-
SHA512
413bf79332518b6af56cc23c162d2b981a94744e463b1a01ab8f3699c681cad077d177e3213132d1791969810bc7065667b331deb4f51570a31c96a625b4c694
-
SSDEEP
12288:9d7uix2TBXVnBGw4I/6QTdp7lRpIlfMer5iiTvdyEp8NMXzp4J2cT3RnnrgYs3aF:98MXzCYqBrfGadT
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\htv.exe," reg.exe -
Executes dropped EXE 1 IoCs
pid Process 2580 htv.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 2612 PING.EXE 4904 PING.EXE 3676 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe 464 PO FILE87965345 exl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 464 PO FILE87965345 exl.exe Token: SeDebugPrivilege 2580 htv.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 464 wrote to memory of 4724 464 PO FILE87965345 exl.exe 88 PID 464 wrote to memory of 4724 464 PO FILE87965345 exl.exe 88 PID 464 wrote to memory of 4724 464 PO FILE87965345 exl.exe 88 PID 4724 wrote to memory of 2612 4724 cmd.exe 90 PID 4724 wrote to memory of 2612 4724 cmd.exe 90 PID 4724 wrote to memory of 2612 4724 cmd.exe 90 PID 464 wrote to memory of 952 464 PO FILE87965345 exl.exe 97 PID 464 wrote to memory of 952 464 PO FILE87965345 exl.exe 97 PID 464 wrote to memory of 952 464 PO FILE87965345 exl.exe 97 PID 952 wrote to memory of 4904 952 cmd.exe 99 PID 952 wrote to memory of 4904 952 cmd.exe 99 PID 952 wrote to memory of 4904 952 cmd.exe 99 PID 4724 wrote to memory of 2244 4724 cmd.exe 100 PID 4724 wrote to memory of 2244 4724 cmd.exe 100 PID 4724 wrote to memory of 2244 4724 cmd.exe 100 PID 952 wrote to memory of 3676 952 cmd.exe 101 PID 952 wrote to memory of 3676 952 cmd.exe 101 PID 952 wrote to memory of 3676 952 cmd.exe 101 PID 952 wrote to memory of 2580 952 cmd.exe 102 PID 952 wrote to memory of 2580 952 cmd.exe 102 PID 952 wrote to memory of 2580 952 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO FILE87965345 exl.exe"C:\Users\Admin\AppData\Local\Temp\PO FILE87965345 exl.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 38 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\htv.exe,"2⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 383⤵
- Runs ping.exe
PID:2612
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\htv.exe,"3⤵
- Modifies WinLogon for persistence
PID:2244
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 40 > nul && copy "C:\Users\Admin\AppData\Local\Temp\PO FILE87965345 exl.exe" "C:\Users\Admin\AppData\Local\htv.exe" && ping 127.0.0.1 -n 40 > nul && "C:\Users\Admin\AppData\Local\htv.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 403⤵
- Runs ping.exe
PID:4904
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 403⤵
- Runs ping.exe
PID:3676
-
-
C:\Users\Admin\AppData\Local\htv.exe"C:\Users\Admin\AppData\Local\htv.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD526fa36b587e07bde2d99f329ba553e9c
SHA15d2b42a954666f85fcf91475c3ec361c4c254764
SHA256511bd4f1051444242dda8ae6df80720106a6b4d60eab89658baffb142affe730
SHA512413bf79332518b6af56cc23c162d2b981a94744e463b1a01ab8f3699c681cad077d177e3213132d1791969810bc7065667b331deb4f51570a31c96a625b4c694
-
Filesize
1.8MB
MD526fa36b587e07bde2d99f329ba553e9c
SHA15d2b42a954666f85fcf91475c3ec361c4c254764
SHA256511bd4f1051444242dda8ae6df80720106a6b4d60eab89658baffb142affe730
SHA512413bf79332518b6af56cc23c162d2b981a94744e463b1a01ab8f3699c681cad077d177e3213132d1791969810bc7065667b331deb4f51570a31c96a625b4c694