Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22/05/2023, 09:00
Static task
static1
Behavioral task
behavioral1
Sample
84bb9599ce3c21f987717207163c0a3c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
84bb9599ce3c21f987717207163c0a3c.exe
Resource
win10v2004-20230220-en
General
-
Target
84bb9599ce3c21f987717207163c0a3c.exe
-
Size
3.0MB
-
MD5
84bb9599ce3c21f987717207163c0a3c
-
SHA1
0e43e8452ea288b84fd0630e03a3b00e3cbfda09
-
SHA256
bbd22134bbbb870710356d411613f6b249f9f38a51841e9780eb2a11340f6728
-
SHA512
dfa10133c139b1380a96c88f3c9c5d167a636e1d10da714732516f43c8256bbaa43fe5510c4ce0fc857edc7b789c8f2902644c4d0e3947fb184c234a25a8328a
-
SSDEEP
3072:Ffd7R6tb/jBP26oxTsitGIRTbW+xqRLOQt0OVvVGb31f3PG5YB:f7ybs6pgGsbJxqRL50OmZPh
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1492 svchost.exe 700 svchost.exe 1328 svchost.exe 1588 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 1492 svchost.exe 1328 svchost.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1708 set thread context of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1492 set thread context of 700 1492 svchost.exe 38 PID 1328 set thread context of 1588 1328 svchost.exe 47 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 472 schtasks.exe 948 schtasks.exe 1164 schtasks.exe -
Suspicious behavior: SetClipboardViewer 2 IoCs
pid Process 700 svchost.exe 1588 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 1696 1708 84bb9599ce3c21f987717207163c0a3c.exe 28 PID 1708 wrote to memory of 524 1708 84bb9599ce3c21f987717207163c0a3c.exe 29 PID 1708 wrote to memory of 524 1708 84bb9599ce3c21f987717207163c0a3c.exe 29 PID 1708 wrote to memory of 524 1708 84bb9599ce3c21f987717207163c0a3c.exe 29 PID 1708 wrote to memory of 524 1708 84bb9599ce3c21f987717207163c0a3c.exe 29 PID 1708 wrote to memory of 1644 1708 84bb9599ce3c21f987717207163c0a3c.exe 31 PID 1708 wrote to memory of 1644 1708 84bb9599ce3c21f987717207163c0a3c.exe 31 PID 1708 wrote to memory of 1644 1708 84bb9599ce3c21f987717207163c0a3c.exe 31 PID 1708 wrote to memory of 1644 1708 84bb9599ce3c21f987717207163c0a3c.exe 31 PID 1644 wrote to memory of 472 1644 cmd.exe 33 PID 1644 wrote to memory of 472 1644 cmd.exe 33 PID 1644 wrote to memory of 472 1644 cmd.exe 33 PID 1644 wrote to memory of 472 1644 cmd.exe 33 PID 1708 wrote to memory of 872 1708 84bb9599ce3c21f987717207163c0a3c.exe 34 PID 1708 wrote to memory of 872 1708 84bb9599ce3c21f987717207163c0a3c.exe 34 PID 1708 wrote to memory of 872 1708 84bb9599ce3c21f987717207163c0a3c.exe 34 PID 1708 wrote to memory of 872 1708 84bb9599ce3c21f987717207163c0a3c.exe 34 PID 1396 wrote to memory of 1492 1396 taskeng.exe 37 PID 1396 wrote to memory of 1492 1396 taskeng.exe 37 PID 1396 wrote to memory of 1492 1396 taskeng.exe 37 PID 1396 wrote to memory of 1492 1396 taskeng.exe 37 PID 1396 wrote to memory of 1492 1396 taskeng.exe 37 PID 1396 wrote to memory of 1492 1396 taskeng.exe 37 PID 1396 wrote to memory of 1492 1396 taskeng.exe 37 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 700 1492 svchost.exe 38 PID 1492 wrote to memory of 1744 1492 svchost.exe 39 PID 1492 wrote to memory of 1744 1492 svchost.exe 39 PID 1492 wrote to memory of 1744 1492 svchost.exe 39 PID 1492 wrote to memory of 1744 1492 svchost.exe 39 PID 1492 wrote to memory of 840 1492 svchost.exe 41 PID 1492 wrote to memory of 840 1492 svchost.exe 41 PID 1492 wrote to memory of 840 1492 svchost.exe 41 PID 1492 wrote to memory of 840 1492 svchost.exe 41 PID 840 wrote to memory of 948 840 cmd.exe 43 PID 840 wrote to memory of 948 840 cmd.exe 43 PID 840 wrote to memory of 948 840 cmd.exe 43 PID 840 wrote to memory of 948 840 cmd.exe 43 PID 1492 wrote to memory of 932 1492 svchost.exe 44 PID 1492 wrote to memory of 932 1492 svchost.exe 44 PID 1492 wrote to memory of 932 1492 svchost.exe 44 PID 1492 wrote to memory of 932 1492 svchost.exe 44 PID 1396 wrote to memory of 1328 1396 taskeng.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\84bb9599ce3c21f987717207163c0a3c.exe"C:\Users\Admin\AppData\Local\Temp\84bb9599ce3c21f987717207163c0a3c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\84bb9599ce3c21f987717207163c0a3c.exe"C:\Users\Admin\AppData\Local\Temp\84bb9599ce3c21f987717207163c0a3c.exe"2⤵PID:1696
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\svchost"2⤵PID:524
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f3⤵
- Creates scheduled task(s)
PID:472
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\84bb9599ce3c21f987717207163c0a3c.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"2⤵PID:872
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {372CAC3C-3FEF-429C-B4CE-B8997DFDEE4F} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeC:\Users\Admin\AppData\Roaming\svchost\svchost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:700
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\svchost"3⤵PID:1744
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f4⤵
- Creates scheduled task(s)
PID:948
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"3⤵PID:932
-
-
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeC:\Users\Admin\AppData\Roaming\svchost\svchost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1328 -
C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:1588
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\svchost"3⤵PID:1028
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f3⤵PID:1596
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f4⤵
- Creates scheduled task(s)
PID:1164
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"3⤵PID:1320
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD584bb9599ce3c21f987717207163c0a3c
SHA10e43e8452ea288b84fd0630e03a3b00e3cbfda09
SHA256bbd22134bbbb870710356d411613f6b249f9f38a51841e9780eb2a11340f6728
SHA512dfa10133c139b1380a96c88f3c9c5d167a636e1d10da714732516f43c8256bbaa43fe5510c4ce0fc857edc7b789c8f2902644c4d0e3947fb184c234a25a8328a
-
Filesize
3.0MB
MD584bb9599ce3c21f987717207163c0a3c
SHA10e43e8452ea288b84fd0630e03a3b00e3cbfda09
SHA256bbd22134bbbb870710356d411613f6b249f9f38a51841e9780eb2a11340f6728
SHA512dfa10133c139b1380a96c88f3c9c5d167a636e1d10da714732516f43c8256bbaa43fe5510c4ce0fc857edc7b789c8f2902644c4d0e3947fb184c234a25a8328a
-
Filesize
3.0MB
MD584bb9599ce3c21f987717207163c0a3c
SHA10e43e8452ea288b84fd0630e03a3b00e3cbfda09
SHA256bbd22134bbbb870710356d411613f6b249f9f38a51841e9780eb2a11340f6728
SHA512dfa10133c139b1380a96c88f3c9c5d167a636e1d10da714732516f43c8256bbaa43fe5510c4ce0fc857edc7b789c8f2902644c4d0e3947fb184c234a25a8328a
-
Filesize
3.0MB
MD584bb9599ce3c21f987717207163c0a3c
SHA10e43e8452ea288b84fd0630e03a3b00e3cbfda09
SHA256bbd22134bbbb870710356d411613f6b249f9f38a51841e9780eb2a11340f6728
SHA512dfa10133c139b1380a96c88f3c9c5d167a636e1d10da714732516f43c8256bbaa43fe5510c4ce0fc857edc7b789c8f2902644c4d0e3947fb184c234a25a8328a
-
Filesize
3.0MB
MD584bb9599ce3c21f987717207163c0a3c
SHA10e43e8452ea288b84fd0630e03a3b00e3cbfda09
SHA256bbd22134bbbb870710356d411613f6b249f9f38a51841e9780eb2a11340f6728
SHA512dfa10133c139b1380a96c88f3c9c5d167a636e1d10da714732516f43c8256bbaa43fe5510c4ce0fc857edc7b789c8f2902644c4d0e3947fb184c234a25a8328a
-
Filesize
3.0MB
MD584bb9599ce3c21f987717207163c0a3c
SHA10e43e8452ea288b84fd0630e03a3b00e3cbfda09
SHA256bbd22134bbbb870710356d411613f6b249f9f38a51841e9780eb2a11340f6728
SHA512dfa10133c139b1380a96c88f3c9c5d167a636e1d10da714732516f43c8256bbaa43fe5510c4ce0fc857edc7b789c8f2902644c4d0e3947fb184c234a25a8328a
-
Filesize
3.0MB
MD584bb9599ce3c21f987717207163c0a3c
SHA10e43e8452ea288b84fd0630e03a3b00e3cbfda09
SHA256bbd22134bbbb870710356d411613f6b249f9f38a51841e9780eb2a11340f6728
SHA512dfa10133c139b1380a96c88f3c9c5d167a636e1d10da714732516f43c8256bbaa43fe5510c4ce0fc857edc7b789c8f2902644c4d0e3947fb184c234a25a8328a