Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
26s -
max time network
31s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2023, 01:10
Behavioral task
behavioral1
Sample
OInstall.exe
Resource
win7-20230621-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
OInstall.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
7 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
OInstall.exe
-
Size
10.9MB
-
MD5
ebc58647462ad9c76395ef451064d115
-
SHA1
14e470812f13b278b2694a4cec5737a39784e9dd
-
SHA256
414155bf11893ec64ba0f4ffb7de92885090845a0761cf8f6743462aa5991d5e
-
SHA512
8a9ef093d151957ae3c4c8e572fcdbd2198398c95ff8186d532853856c12c8f9ae7408c4f24518c5903faa517ea4e1d5779e797c5a4d850073fbee3ab801e8cc
-
SSDEEP
196608:2ZnMGjZsDEsCaYsGEHy61bgUhufRswPU2/V8Gd83/PALDP0PiaQxhwf+9zYul28S:WnjZhsCOU6ZgfPPPuGdnv0fzfoDYtB
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1468 files.dat -
resource yara_rule behavioral2/memory/4220-133-0x0000000000400000-0x000000000199D000-memory.dmp upx behavioral2/memory/4220-150-0x0000000000400000-0x000000000199D000-memory.dmp upx behavioral2/memory/4220-151-0x0000000000400000-0x000000000199D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "51" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5084 WMIC.exe Token: SeSecurityPrivilege 5084 WMIC.exe Token: SeTakeOwnershipPrivilege 5084 WMIC.exe Token: SeLoadDriverPrivilege 5084 WMIC.exe Token: SeSystemProfilePrivilege 5084 WMIC.exe Token: SeSystemtimePrivilege 5084 WMIC.exe Token: SeProfSingleProcessPrivilege 5084 WMIC.exe Token: SeIncBasePriorityPrivilege 5084 WMIC.exe Token: SeCreatePagefilePrivilege 5084 WMIC.exe Token: SeBackupPrivilege 5084 WMIC.exe Token: SeRestorePrivilege 5084 WMIC.exe Token: SeShutdownPrivilege 5084 WMIC.exe Token: SeDebugPrivilege 5084 WMIC.exe Token: SeSystemEnvironmentPrivilege 5084 WMIC.exe Token: SeRemoteShutdownPrivilege 5084 WMIC.exe Token: SeUndockPrivilege 5084 WMIC.exe Token: SeManageVolumePrivilege 5084 WMIC.exe Token: 33 5084 WMIC.exe Token: 34 5084 WMIC.exe Token: 35 5084 WMIC.exe Token: 36 5084 WMIC.exe Token: SeIncreaseQuotaPrivilege 5084 WMIC.exe Token: SeSecurityPrivilege 5084 WMIC.exe Token: SeTakeOwnershipPrivilege 5084 WMIC.exe Token: SeLoadDriverPrivilege 5084 WMIC.exe Token: SeSystemProfilePrivilege 5084 WMIC.exe Token: SeSystemtimePrivilege 5084 WMIC.exe Token: SeProfSingleProcessPrivilege 5084 WMIC.exe Token: SeIncBasePriorityPrivilege 5084 WMIC.exe Token: SeCreatePagefilePrivilege 5084 WMIC.exe Token: SeBackupPrivilege 5084 WMIC.exe Token: SeRestorePrivilege 5084 WMIC.exe Token: SeShutdownPrivilege 5084 WMIC.exe Token: SeDebugPrivilege 5084 WMIC.exe Token: SeSystemEnvironmentPrivilege 5084 WMIC.exe Token: SeRemoteShutdownPrivilege 5084 WMIC.exe Token: SeUndockPrivilege 5084 WMIC.exe Token: SeManageVolumePrivilege 5084 WMIC.exe Token: 33 5084 WMIC.exe Token: 34 5084 WMIC.exe Token: 35 5084 WMIC.exe Token: 36 5084 WMIC.exe Token: SeIncreaseQuotaPrivilege 4816 WMIC.exe Token: SeSecurityPrivilege 4816 WMIC.exe Token: SeTakeOwnershipPrivilege 4816 WMIC.exe Token: SeLoadDriverPrivilege 4816 WMIC.exe Token: SeSystemProfilePrivilege 4816 WMIC.exe Token: SeSystemtimePrivilege 4816 WMIC.exe Token: SeProfSingleProcessPrivilege 4816 WMIC.exe Token: SeIncBasePriorityPrivilege 4816 WMIC.exe Token: SeCreatePagefilePrivilege 4816 WMIC.exe Token: SeBackupPrivilege 4816 WMIC.exe Token: SeRestorePrivilege 4816 WMIC.exe Token: SeShutdownPrivilege 4816 WMIC.exe Token: SeDebugPrivilege 4816 WMIC.exe Token: SeSystemEnvironmentPrivilege 4816 WMIC.exe Token: SeRemoteShutdownPrivilege 4816 WMIC.exe Token: SeUndockPrivilege 4816 WMIC.exe Token: SeManageVolumePrivilege 4816 WMIC.exe Token: 33 4816 WMIC.exe Token: 34 4816 WMIC.exe Token: 35 4816 WMIC.exe Token: 36 4816 WMIC.exe Token: SeIncreaseQuotaPrivilege 4816 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1648 LogonUI.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4220 wrote to memory of 2708 4220 OInstall.exe 84 PID 4220 wrote to memory of 2708 4220 OInstall.exe 84 PID 2708 wrote to memory of 5084 2708 cmd.exe 86 PID 2708 wrote to memory of 5084 2708 cmd.exe 86 PID 4220 wrote to memory of 4188 4220 OInstall.exe 88 PID 4220 wrote to memory of 4188 4220 OInstall.exe 88 PID 4188 wrote to memory of 4816 4188 cmd.exe 90 PID 4188 wrote to memory of 4816 4188 cmd.exe 90 PID 4220 wrote to memory of 4176 4220 OInstall.exe 91 PID 4220 wrote to memory of 4176 4220 OInstall.exe 91 PID 4176 wrote to memory of 1468 4176 cmd.exe 93 PID 4176 wrote to memory of 1468 4176 cmd.exe 93 PID 4176 wrote to memory of 1468 4176 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\OInstall.exe"C:\Users\Admin\AppData\Local\Temp\OInstall.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"2⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto2⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\files\files.datfiles.dat -y -pkmsauto3⤵
- Executes dropped EXE
PID:1468
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa399b855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
707KB
MD555d21b2c272a5d6b9f54fa9ed82bf9eb
SHA132464cba823cd9b7e94e4fa1a32a8f2344b0f33b
SHA2567a1c82e264258470d14ca345ea1a9b6fc34fa19b393a92077a01be5f1ad08f47
SHA5121b68d0c61367717529be4a3aa347bb69d3e21de7a89b10e8b0aa54d40af988cc0cc8e63298ba595a93c3372aca3770ace1eee2780a59238d0948499dbb4be725
-
Filesize
707KB
MD555d21b2c272a5d6b9f54fa9ed82bf9eb
SHA132464cba823cd9b7e94e4fa1a32a8f2344b0f33b
SHA2567a1c82e264258470d14ca345ea1a9b6fc34fa19b393a92077a01be5f1ad08f47
SHA5121b68d0c61367717529be4a3aa347bb69d3e21de7a89b10e8b0aa54d40af988cc0cc8e63298ba595a93c3372aca3770ace1eee2780a59238d0948499dbb4be725