Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
28s -
max time network
33s -
platform
windows10-1703_x64 -
resource
win10-20230621-en -
resource tags
arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system -
submitted
30/06/2023, 21:21
Behavioral task
behavioral1
Sample
OInstall.exe
Resource
win10-20230621-en
windows10-1703-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
out.exe
Resource
win10-20230621-en
windows10-1703-x64
0 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
OInstall.exe
-
Size
10.9MB
-
MD5
ebc58647462ad9c76395ef451064d115
-
SHA1
14e470812f13b278b2694a4cec5737a39784e9dd
-
SHA256
414155bf11893ec64ba0f4ffb7de92885090845a0761cf8f6743462aa5991d5e
-
SHA512
8a9ef093d151957ae3c4c8e572fcdbd2198398c95ff8186d532853856c12c8f9ae7408c4f24518c5903faa517ea4e1d5779e797c5a4d850073fbee3ab801e8cc
-
SSDEEP
196608:2ZnMGjZsDEsCaYsGEHy61bgUhufRswPU2/V8Gd83/PALDP0PiaQxhwf+9zYul28S:WnjZhsCOU6ZgfPPPuGdnv0fzfoDYtB
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4844 files.dat -
resource yara_rule behavioral1/memory/2468-120-0x0000000000400000-0x000000000199D000-memory.dmp upx behavioral1/memory/2468-137-0x0000000000400000-0x000000000199D000-memory.dmp upx behavioral1/memory/2468-139-0x0000000000400000-0x000000000199D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5000 WMIC.exe Token: SeSecurityPrivilege 5000 WMIC.exe Token: SeTakeOwnershipPrivilege 5000 WMIC.exe Token: SeLoadDriverPrivilege 5000 WMIC.exe Token: SeSystemProfilePrivilege 5000 WMIC.exe Token: SeSystemtimePrivilege 5000 WMIC.exe Token: SeProfSingleProcessPrivilege 5000 WMIC.exe Token: SeIncBasePriorityPrivilege 5000 WMIC.exe Token: SeCreatePagefilePrivilege 5000 WMIC.exe Token: SeBackupPrivilege 5000 WMIC.exe Token: SeRestorePrivilege 5000 WMIC.exe Token: SeShutdownPrivilege 5000 WMIC.exe Token: SeDebugPrivilege 5000 WMIC.exe Token: SeSystemEnvironmentPrivilege 5000 WMIC.exe Token: SeRemoteShutdownPrivilege 5000 WMIC.exe Token: SeUndockPrivilege 5000 WMIC.exe Token: SeManageVolumePrivilege 5000 WMIC.exe Token: 33 5000 WMIC.exe Token: 34 5000 WMIC.exe Token: 35 5000 WMIC.exe Token: 36 5000 WMIC.exe Token: SeIncreaseQuotaPrivilege 5000 WMIC.exe Token: SeSecurityPrivilege 5000 WMIC.exe Token: SeTakeOwnershipPrivilege 5000 WMIC.exe Token: SeLoadDriverPrivilege 5000 WMIC.exe Token: SeSystemProfilePrivilege 5000 WMIC.exe Token: SeSystemtimePrivilege 5000 WMIC.exe Token: SeProfSingleProcessPrivilege 5000 WMIC.exe Token: SeIncBasePriorityPrivilege 5000 WMIC.exe Token: SeCreatePagefilePrivilege 5000 WMIC.exe Token: SeBackupPrivilege 5000 WMIC.exe Token: SeRestorePrivilege 5000 WMIC.exe Token: SeShutdownPrivilege 5000 WMIC.exe Token: SeDebugPrivilege 5000 WMIC.exe Token: SeSystemEnvironmentPrivilege 5000 WMIC.exe Token: SeRemoteShutdownPrivilege 5000 WMIC.exe Token: SeUndockPrivilege 5000 WMIC.exe Token: SeManageVolumePrivilege 5000 WMIC.exe Token: 33 5000 WMIC.exe Token: 34 5000 WMIC.exe Token: 35 5000 WMIC.exe Token: 36 5000 WMIC.exe Token: SeIncreaseQuotaPrivilege 4008 WMIC.exe Token: SeSecurityPrivilege 4008 WMIC.exe Token: SeTakeOwnershipPrivilege 4008 WMIC.exe Token: SeLoadDriverPrivilege 4008 WMIC.exe Token: SeSystemProfilePrivilege 4008 WMIC.exe Token: SeSystemtimePrivilege 4008 WMIC.exe Token: SeProfSingleProcessPrivilege 4008 WMIC.exe Token: SeIncBasePriorityPrivilege 4008 WMIC.exe Token: SeCreatePagefilePrivilege 4008 WMIC.exe Token: SeBackupPrivilege 4008 WMIC.exe Token: SeRestorePrivilege 4008 WMIC.exe Token: SeShutdownPrivilege 4008 WMIC.exe Token: SeDebugPrivilege 4008 WMIC.exe Token: SeSystemEnvironmentPrivilege 4008 WMIC.exe Token: SeRemoteShutdownPrivilege 4008 WMIC.exe Token: SeUndockPrivilege 4008 WMIC.exe Token: SeManageVolumePrivilege 4008 WMIC.exe Token: 33 4008 WMIC.exe Token: 34 4008 WMIC.exe Token: 35 4008 WMIC.exe Token: 36 4008 WMIC.exe Token: SeIncreaseQuotaPrivilege 4008 WMIC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4784 LogonUI.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2468 wrote to memory of 4324 2468 OInstall.exe 66 PID 2468 wrote to memory of 4324 2468 OInstall.exe 66 PID 4324 wrote to memory of 5000 4324 cmd.exe 68 PID 4324 wrote to memory of 5000 4324 cmd.exe 68 PID 2468 wrote to memory of 344 2468 OInstall.exe 70 PID 2468 wrote to memory of 344 2468 OInstall.exe 70 PID 2468 wrote to memory of 2952 2468 OInstall.exe 72 PID 2468 wrote to memory of 2952 2468 OInstall.exe 72 PID 344 wrote to memory of 4008 344 cmd.exe 74 PID 344 wrote to memory of 4008 344 cmd.exe 74 PID 2952 wrote to memory of 4844 2952 cmd.exe 75 PID 2952 wrote to memory of 4844 2952 cmd.exe 75 PID 2952 wrote to memory of 4844 2952 cmd.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\OInstall.exe"C:\Users\Admin\AppData\Local\Temp\OInstall.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\System32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"2⤵
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto2⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\files\files.datfiles.dat -y -pkmsauto3⤵
- Executes dropped EXE
PID:4844
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ad3855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4784
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
707KB
MD555d21b2c272a5d6b9f54fa9ed82bf9eb
SHA132464cba823cd9b7e94e4fa1a32a8f2344b0f33b
SHA2567a1c82e264258470d14ca345ea1a9b6fc34fa19b393a92077a01be5f1ad08f47
SHA5121b68d0c61367717529be4a3aa347bb69d3e21de7a89b10e8b0aa54d40af988cc0cc8e63298ba595a93c3372aca3770ace1eee2780a59238d0948499dbb4be725
-
Filesize
707KB
MD555d21b2c272a5d6b9f54fa9ed82bf9eb
SHA132464cba823cd9b7e94e4fa1a32a8f2344b0f33b
SHA2567a1c82e264258470d14ca345ea1a9b6fc34fa19b393a92077a01be5f1ad08f47
SHA5121b68d0c61367717529be4a3aa347bb69d3e21de7a89b10e8b0aa54d40af988cc0cc8e63298ba595a93c3372aca3770ace1eee2780a59238d0948499dbb4be725