Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
30/06/2023, 01:19
Static task
static1
Behavioral task
behavioral1
Sample
2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
Resource
win10v2004-20230621-en
General
-
Target
2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe
-
Size
8.2MB
-
MD5
49821681a577c7aa118eca3400d71d53
-
SHA1
e96ae5a5f90e3a4622b64e91d374bbbd102165d3
-
SHA256
2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88
-
SHA512
5985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002
-
SSDEEP
196608:ihTb9B0BPrDz4pxgZZPy5RmStgxb/z6FDiSJXqeUh4mT:MTb9epDz4MZZ4RmxYDiScfhH
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.lnk 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.lnk 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Executes dropped EXE 2 IoCs
pid Process 1600 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 1812 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Loads dropped DLL 1 IoCs
pid Process 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3297628651-743815474-1126733160-1000\Software\Microsoft\Windows\CurrentVersion\Run\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88 = "C:\\Users\\Admin\\AppData\\Roaming\\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe" 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1536 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1996 powershell.exe 1344 powershell.exe 1756 powershell.exe 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe Token: SeDebugPrivilege 1996 powershell.exe Token: SeDebugPrivilege 1344 powershell.exe Token: SeDebugPrivilege 1756 powershell.exe Token: SeDebugPrivilege 1600 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1996 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 28 PID 1704 wrote to memory of 1996 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 28 PID 1704 wrote to memory of 1996 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 28 PID 1704 wrote to memory of 1996 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 28 PID 1704 wrote to memory of 1344 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 30 PID 1704 wrote to memory of 1344 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 30 PID 1704 wrote to memory of 1344 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 30 PID 1704 wrote to memory of 1344 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 30 PID 1704 wrote to memory of 1756 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 32 PID 1704 wrote to memory of 1756 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 32 PID 1704 wrote to memory of 1756 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 32 PID 1704 wrote to memory of 1756 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 32 PID 1704 wrote to memory of 1536 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 34 PID 1704 wrote to memory of 1536 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 34 PID 1704 wrote to memory of 1536 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 34 PID 1704 wrote to memory of 1536 1704 2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe 34 PID 1552 wrote to memory of 1600 1552 taskeng.exe 37 PID 1552 wrote to memory of 1600 1552 taskeng.exe 37 PID 1552 wrote to memory of 1600 1552 taskeng.exe 37 PID 1552 wrote to memory of 1600 1552 taskeng.exe 37 PID 1552 wrote to memory of 1812 1552 taskeng.exe 38 PID 1552 wrote to memory of 1812 1552 taskeng.exe 38 PID 1552 wrote to memory of 1812 1552 taskeng.exe 38 PID 1552 wrote to memory of 1812 1552 taskeng.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe"C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88" /tr "C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe"2⤵
- Creates scheduled task(s)
PID:1536
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {0A0AF473-3290-4637-A4C5-394BD5AF7B8E} S-1-5-21-3297628651-743815474-1126733160-1000:HHVWDVKF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exeC:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exeC:\Users\Admin\AppData\Roaming\2658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88.exe2⤵
- Executes dropped EXE
PID:1812
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD549821681a577c7aa118eca3400d71d53
SHA1e96ae5a5f90e3a4622b64e91d374bbbd102165d3
SHA2562658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88
SHA5125985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002
-
Filesize
8.2MB
MD549821681a577c7aa118eca3400d71d53
SHA1e96ae5a5f90e3a4622b64e91d374bbbd102165d3
SHA2562658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88
SHA5125985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002
-
Filesize
8.2MB
MD549821681a577c7aa118eca3400d71d53
SHA1e96ae5a5f90e3a4622b64e91d374bbbd102165d3
SHA2562658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88
SHA5125985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002
-
Filesize
8.2MB
MD549821681a577c7aa118eca3400d71d53
SHA1e96ae5a5f90e3a4622b64e91d374bbbd102165d3
SHA2562658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88
SHA5125985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G919DCH8XQ3GZAHKW32Z.temp
Filesize7KB
MD576f5d4f94139aaf6e01b228583d1e4b9
SHA17aa0634c9219736ffc8cef101c566ef8ef560ae4
SHA2568dbd680f3dc1a9f235aea865ae6869250cfca17c5593e54f4ee43d74ecc9faee
SHA512512934774d8c10336f5e285e199878b27291304471acdc69f39db8707567c53fe629681cb0b0f32ec6c3b010c208063bbf40dbdeaed590dbac9b7d8d95249efb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD576f5d4f94139aaf6e01b228583d1e4b9
SHA17aa0634c9219736ffc8cef101c566ef8ef560ae4
SHA2568dbd680f3dc1a9f235aea865ae6869250cfca17c5593e54f4ee43d74ecc9faee
SHA512512934774d8c10336f5e285e199878b27291304471acdc69f39db8707567c53fe629681cb0b0f32ec6c3b010c208063bbf40dbdeaed590dbac9b7d8d95249efb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD576f5d4f94139aaf6e01b228583d1e4b9
SHA17aa0634c9219736ffc8cef101c566ef8ef560ae4
SHA2568dbd680f3dc1a9f235aea865ae6869250cfca17c5593e54f4ee43d74ecc9faee
SHA512512934774d8c10336f5e285e199878b27291304471acdc69f39db8707567c53fe629681cb0b0f32ec6c3b010c208063bbf40dbdeaed590dbac9b7d8d95249efb
-
Filesize
8.2MB
MD549821681a577c7aa118eca3400d71d53
SHA1e96ae5a5f90e3a4622b64e91d374bbbd102165d3
SHA2562658355af06f2bd5c9bb325e856723a362efcd9d9a8ee6a7c7f6ae5f85214e88
SHA5125985f9fe71814ebf41786ddb3c4d7a37cc31e79d81aab0d8008ab701325c404c1316a78eb96ace3f2be4394f3c4eed7249e1d54b526b1d8f6e84f00a18ef0002