Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
30/06/2023, 20:29
Behavioral task
behavioral1
Sample
9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe
Resource
win7-20230621-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe
-
Size
174KB
-
MD5
699f5196060a3124f55918b8f3d40227
-
SHA1
775003cbb94339986e7a43afef3b8dffce714546
-
SHA256
9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32
-
SHA512
4b748eee1f430f6d9185a977e8361fa2e788b7ba844a2b02018b2e9d34649f11b05b9204a6d9e77341be57f9e33c4a9bec830bbd849f24b6e2a08c73e7f4a18c
-
SSDEEP
3072:CYOoXSH2e5kqL7RJsgQKxF//tUPzsFst3rJ/g/9J5B+oQc5O1/EY7:CYfSr5khgQKD//C4FS3dg/XD+RTxE
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1508 explorer.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe Token: SeDebugPrivilege 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe Token: 33 1296 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1296 AUDIODG.EXE Token: 33 1296 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1296 AUDIODG.EXE Token: SeShutdownPrivilege 1508 explorer.exe Token: SeShutdownPrivilege 1508 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe -
Suspicious use of SendNotifyMessage 16 IoCs
pid Process 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe 1508 explorer.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2036 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe 28 PID 2032 wrote to memory of 2036 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe 28 PID 2032 wrote to memory of 2036 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe 28 PID 2032 wrote to memory of 2036 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe 28 PID 2032 wrote to memory of 2036 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe 28 PID 2032 wrote to memory of 2036 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe 28 PID 2032 wrote to memory of 2036 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe 28 PID 2032 wrote to memory of 1508 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe 29 PID 2032 wrote to memory of 1508 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe 29 PID 2032 wrote to memory of 1508 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe 29 PID 2032 wrote to memory of 1508 2032 9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe"C:\Users\Admin\AppData\Local\Temp\9285f051f34a6709c1255f8d243b474161074a4377120bb158c82e6c8e1ceb32.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u /s "C:\Users\seewo\AppData\Local\YunPan\Bin\x64\YuWangExt.dll"2⤵PID:2036
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1508
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x17c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1296